Hmmm. BackupRead and BackupWrite when called with an async handle sometimes finish sync and sometimes async, so any caller calling async who managed to deal with the stack corruption must be capable of receiving a sync complete.
This makes for a solution.
If the underlying call returns ERROR_IO_PENDING, immediately call WaitForSingleObject(handle, INFINITE), followed by GetOverlappedResult(), which has the effect of converting the async call to sync.
[Unless the application was relying on the async behavior. For example, calling
WaitForSingleObject on the handle blocks APCs, including the oplock release request which is preventing the BackupRead from completing! -Raymond]