UIA: retrieve full buffer size sometimes

src/types/UiaTextRangeBase.cpp

@@ -145,7 +145,9 @@ const COORD UiaTextRangeBase::GetEndpoint(TextPatternRangeEndpoint endpoint) con
 // - true if range is degenerate, false otherwise.
 bool UiaTextRangeBase::SetEndpoint(TextPatternRangeEndpoint endpoint, const COORD val) noexcept
 {
-    const auto bufferSize = _getBufferSize();
+    // GH#6402: Get the actual buffer size here, instead of the one
+    //          constructed by the virtual bottom.
+    const auto bufferSize = _pData->GetTextBuffer().GetSize();
     switch (endpoint)
     {
     case TextPatternRangeEndpoint_End:
@@ -393,7 +395,9 @@ IFACEMETHODIMP UiaTextRangeBase::GetBoundingRectangles(_Outptr_result_maybenull_
         // set of coords.
         std::vector<double> coords;
 
-        const auto bufferSize = _getBufferSize();
+        // GH#6402: Get the actual buffer size here, instead of the one
+        //          constructed by the virtual bottom.
+        const auto bufferSize = _pData->GetTextBuffer().GetSize();
 
         // these viewport vars are converted to the buffer coordinate space
         const auto viewport = bufferSize.ConvertToOrigin(_pData->GetViewport());