Great !

Thanks for sharing your findings !

One last thing, you are leaking your opt object. You should rather build it on the stack and pass its address to subControlRect.