win_readlink in Modules/posixmodule.c mistakenly treats the PrintNameOffset field of the reparse data buffer as a number of characters instead of bytes. Thus, if the offset is non-zero, the value returned is incorrect stack garbage. For example, the following should return "C:\\ProgramData":
>>> os.readlink(r'C:\Users\All Users')
'\u6c20\u3012\u041f\x01\u2768\u60b2\u031b\x02\x05\x00\u031e\x06\u8c01\u4012'
Craig Holmquist found this bug, as detailed in message 277385. He included a fix in the patch for issue 23407, but this should be addressed in the next maintenance release of 3.5 and 3.6.