pidl:NDR/Client: fix dcerpc_function() with [out,ref] pointers