NetUserEnum API 的封装问题

这个API 的原型如下：NET_API_STATUS NetUserEnum(
  LPCWSTR servername,    
  DWORD level,           
  DWORD filter,          
  LPBYTE *bufptr,        
  DWORD prefmaxlen,      
  LPDWORD entriesread,   
  LPDWORD totalentries,  
  LPDWORD resume_handle  
);我翻译成这样：TFnNetUserEnum = function(ServerName: PWideChar;
                          Level: DWORD;
                          Filter: DWORD;
                          Bufptr: PByte;
                          prefmaxlen: DWORD;
                          entriesread: PDWORD;
                          totalentries: PDWORD;
                          resume_handle: PDWORD
                         ): DWORD; stdcall;然后是这样使用的：
var
    fnNetUserEnum: TFnNetUserEnum;
    hNetAPI32: THandle;
    wszBuff: array[1..256] of WideChar;
    nStatus: Integer;
    pBuffer: PUSER_INFO_1;
    dwPrefMaxLen: DWORD;
    dwEntriesRead: DWORD;
    dwTotalEntries: DWORD;
    dwResumeHandle: DWORD;
begin
    hNetAPI32 := LoadLibrary('NETAPI32.DLL');
    
    @fnNetApiBufferFree := GetProcAddress(hNetAPI32, 'NetApiBufferFree');    nStatus := fnNetUserEnum(@wszBuff, 1, FILTER_NORMAL_ACCOUNT,
                             PByte(pBuffer),
                             dwPrefMaxLen,
                             @dwEntriesRead,
                             @dwTotalEntries,
                             @dwResumeHandle
                             );
end;结果调用到nStatus := fnNetUserEnum(...)这句时一直说我
"Write of address 0000000"，是NETAPI32.DLL 出错。请问是怎么回事呢？