I need to get the path to the native (rather than the WOW) program files directory from a 32bit WOW process.
When I pass CSIDL_PROGRAM_FILES (or CSIDL_PROGRAM_FILESX86)
This is almost certainly a bad idea, according to a recent-ish post by the infamous Raymond Chen. See here for details. Bottom line, I think it can be done, but it's a lot of hard work and there's almost certainly an easier way.
Microsoft built the WOW emulation layer to make your life easier. Don't waste all their time and effort by fighting it :-).
Perhaps if you told us why you need the non-WOW Program Files directory, we could assist further.