Lurking bug found by patch for 531291: FSSpecs should be passed to
Py_BuildValue by address, not by value.

2.2.1 candidate.
diff --git a/Mac/Modules/cf/_CFmodule.c b/Mac/Modules/cf/_CFmodule.c
index a47fe85..d69fce7 100644
--- a/Mac/Modules/cf/_CFmodule.c
+++ b/Mac/Modules/cf/_CFmodule.c
@@ -2791,7 +2791,7 @@
 	                    &fsRef);
 	_res = Py_BuildValue("lO&",
 	                     _rv,
-	                     PyMac_BuildFSRef, fsRef);
+	                     PyMac_BuildFSRef, &fsRef);
 	return _res;
 }
 
diff --git a/Mac/Modules/win/_Winmodule.c b/Mac/Modules/win/_Winmodule.c
index 6db74a9..80e4040 100644
--- a/Mac/Modules/win/_Winmodule.c
+++ b/Mac/Modules/win/_Winmodule.c
@@ -1172,7 +1172,7 @@
 	                            &outFile);
 	if (_err != noErr) return PyMac_Error(_err);
 	_res = Py_BuildValue("O&",
-	                     PyMac_BuildFSSpec, outFile);
+	                     PyMac_BuildFSSpec, &outFile);
 	return _res;
 }