[NTOSKNRL] Only allocate a MDL if we have an output length

For user mode, when probing output buffer, if it's null, length
will also be set to 0.

This avoids user mode applications being able to trigger various
asserts in ReactOS (and thus BSOD when no debugger is plugged ;-)).