August 2026 - Wine-Bugs - list.winehq.org

[Bug 60241] New: Claude Core review report(a lot of copy paste and logic bugs uncovered)
by WineHQ Bugzilla Sept. 12, 2026

Sept. 12, 2026

http://bugs.winehq.org/show_bug.cgi?id=60241 Bug ID: 60241 Summary: Claude Core review report(a lot of copy paste and logic bugs uncovered) Product: Wine Version: 11.15 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)list.winehq.org Reporter: mikrutrafal(a)protonmail.com Target Milestone: --- Distribution: --- Created attachment 81942 --> http://bugs.winehq.org/attachment.cgi?id=81942 Html report, with ~1900 possible bugs in various modules Over the past month, whenever I had some free tokens available, I used Claude Code to review the Wine(and also other open source projects) codebase step by step I have attached an HTML file containing the graphical report, which contains info about ~1900 problematic places(copy-paste bugs, use-after-free, logic problems, etc.). I know that reporting multiple problems in a single bug report is usually not encouraged, but otherwise I would have flooded the entire Bugzilla tracker. Html report can also be found here: https://github.com/qarmin/ClaudeReports/blob/master/wine_20260823.html I have created reports using the same html template for many other open-source projects, like Box64, FEX, image-rs, lofty, Strawberry, and many others. These projects have already fixed bugs that were found through these reports(there were also some false positives). The report contains direct links to the Wine GitLab repository, the exact commit on which the report was created, a description of each bug, and a possible fix. I can regenerate the report if needed. Here are some examples of bugs that I'm sure are actual bugs: //////////////////////////////////////////////////// ### CPY_3 `HIGH` **Description:** In `ImmGetImeMenuItemsA` and `ImmGetImeMenuItemsW`, the per-item conversion loop copies from a fixed index `1` instead of the loop variable `i`: `memcpy( &menuA[i], &menuW[1], sizeof(IMEMENUITEMINFOA) )` and, symmetrically, `memcpy( &menuW[i], &menuA[1], sizeof(IMEMENUITEMINFOA) )`. Every output element ends up filled with data copied from source index `1` (wrong data for all `i != 1`), and when `ret` is `1` this also reads `menuW[1]`/`menuA[1]`, one element past what was populated/allocated for a single-item result - an out-of-bounds read. **Locations:** ```c memcpy( &menuA[i], &menuW[1], sizeof(IMEMENUITEMINFOA) ); ``` **Fix:** Use the loop index instead of the literal `1` in both functions: ```c memcpy( &menuA[i], &menuW[i], sizeof(IMEMENUITEMINFOA) ); ``` //////////////////////////////////////////////////// ### LOGIC_66 `MEDIUM` **Description:** In `EMFDC_PlgBlt()`, the bounding-box computation loop updates `x_min`, `y_min`, `x_max` correctly with `min()`/`max()` against their own running value, but `y_max` is computed with `max( y_min, points[i].y )` instead of `max( y_max, points[i].y )`. This is a copy-paste typo that makes the computed `emr->rclBounds.bottom` wrong whenever `y_max` and `y_min` diverge. **Locations:** dlls/gdi32/emfdc.c:1875 ``` x_min = min( x_min, points[i].x ); y_min = min( y_min, points[i].y ); x_max = max( x_max, points[i].x ); y_max = max( y_min, points[i].y ); ``` **Fix:** ```c // before y_max = max( y_min, points[i].y ); // after y_max = max( y_max, points[i].y ); ``` //////////////////////////////////////////////////// ### CPY_52 `MEDIUM` **Description:** In `ace_flags_to_samba()` the branch for `CONTAINER_INHERIT_ACE` sets `SEC_ACE_FLAG_NO_PROPAGATE_INHERIT` instead of `SEC_ACE_FLAG_CONTAINER_INHERIT`. This is a copy-paste from the next line (`NO_PROPAGATE_INHERIT_ACE`), so `CONTAINER_INHERIT_ACE` is silently dropped and duplicated as `NO_PROPAGATE_INHERIT_ACE` whenever a share's DACL/SACL ACE flags are converted for Samba, corrupting ACL inheritance semantics passed to `NetShareAdd`/`NetShareGetInfo`. **Locations:** dlls/netapi32/unixlib.c:427 ``` if (flags & OBJECT_INHERIT_ACE) ret |= SEC_ACE_FLAG_OBJECT_INHERIT; if (flags & CONTAINER_INHERIT_ACE) ret |= SEC_ACE_FLAG_NO_PROPAGATE_INHERIT; if (flags & NO_PROPAGATE_INHERIT_ACE) ret |= SEC_ACE_FLAG_NO_PROPAGATE_INHERIT; ``` **Fix:** Change the `CONTAINER_INHERIT_ACE` mapping to use the correct destination flag: ```c if (flags & OBJECT_INHERIT_ACE) ret |= SEC_ACE_FLAG_OBJECT_INHERIT; if (flags & CONTAINER_INHERIT_ACE) ret |= SEC_ACE_FLAG_CONTAINER_INHERIT; if (flags & NO_PROPAGATE_INHERIT_ACE) ret |= SEC_ACE_FLAG_NO_PROPAGATE_INHERIT; ``` -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 39

[Bug 49747] New: ICO_ExtractIconExW causes crash on incomplete windows executable
by WineHQ Bugzilla Sept. 12, 2026

Sept. 12, 2026

https://bugs.winehq.org/show_bug.cgi?id=49747 Bug ID: 49747 Summary: ICO_ExtractIconExW causes crash on incomplete windows executable Product: Wine Version: 5.0 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: user32 Assignee: wine-bugs(a)winehq.org Reporter: andi(a)notmuch.email Distribution: --- Created attachment 68049 --> https://bugs.winehq.org/attachment.cgi?id=68049 backtrace of explorer.exe crashing I have 31% of a binary in a local directory because some installer/patcher crashed during installation. Whenever I use `winefile` or `wine explorer.exe` and scroll to that file in the directory wine crashes with the attached backtrace. It appears to be related to the ICO handling code within wine that expects more input but that doesn't exist yet. Attached is the backtrace of running the patcher for the "Dark Age of Camelot" freeshard "Phoenix" (https://playphoenix.online) which did cause this issue for me. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 7

[Bug 48415] New: The Magic School Bus Explores The Solar System fails to install
by WineHQ Bugzilla Sept. 11, 2026

Sept. 11, 2026

https://bugs.winehq.org/show_bug.cgi?id=48415 Bug ID: 48415 Summary: The Magic School Bus Explores The Solar System fails to install Product: Wine Version: 4.21 Hardware: x86 OS: Linux Status: NEW Keywords: regression Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs(a)winehq.org Reporter: z.figura12(a)gmail.com Regression SHA1: f2060812418bc049105c2a30ceb039ee6d5f0fd7 Distribution: --- It claims: "File Copy operation failed - incorrect number of bytes written to disk - source file or destination disk may be corrupted - use ChkDsk. Source: '\\?\D:\MSBSOLAR\SETUP\_MSSETUP.EXE' Dest: 'C:\WINDOWS\_MSRSTRT.EXE'." Patch sent. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 4

[Bug 52254] New: Cold Steel Subs: Application is not transparent (relies on DwmExtendFrameIntoClientArea)
by WineHQ Bugzilla Sept. 11, 2026

Sept. 11, 2026

https://bugs.winehq.org/show_bug.cgi?id=52254 Bug ID: 52254 Summary: Cold Steel Subs: Application is not transparent (relies on DwmExtendFrameIntoClientArea) Product: Wine Version: 7.0-rc2 Hardware: x86-64 URL: https://zerofield.net/2020/09/30/hajimari-no-kiseki-sp readsheet-translation/ OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: dwmapi Assignee: wine-bugs(a)winehq.org Reporter: johnny(a)localmomentum.net Distribution: --- Created attachment 71376 --> https://bugs.winehq.org/attachment.cgi?id=71376 ColdSteelSubs transparency code (currently not in the distributed application) This application provides a transparent clickthrough overlay to show English translations on top of the original Japanese source. It relies on layered windows and DwmExtendFrameIntoClientArea to handle the transparent display. Currently, the main UI elements show, but the game (or any other application) does not show through. This seems to be because DwmExtendFrameIntoClientArea is only a stub. I'm not sure if that's the only reason it's not transparent, but it's at least one of the reasons. The program itself uses the unity3d engine along with some native dll calls to the relevant user32 apis to handle the transparency. I was able to get a copy of the relevant code (but not the whole application), of which I will attach. Since I can't get all of the code, I've been using an unity sample application to try to figure out some parts myself (the relevant code is here https://github.com/pheonise/Unity3D-Desktop-Overlay/blob/master/Assets/Scri…) This unity3d application works as expected on windows, but is not transparent via wine (as expected). When i comment the call to DwmExtendFrameIntoClientArea, then it its also no longer transparent on windows as well. It seems that if the sample application works, then I can make sure the dev applies to the same technique to the overlay application. Please let me know If i can provide any more information. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 18

[Bug 59846] New: Worms Forts: Under Siege (GOG.com) crashes on start when trying to play the intro
by WineHQ Bugzilla Sept. 11, 2026

Sept. 11, 2026

http://bugs.winehq.org/show_bug.cgi?id=59846 Bug ID: 59846 Summary: Worms Forts: Under Siege (GOG.com) crashes on start when trying to play the intro Product: Wine Version: 11.9 Hardware: x86-64 OS: Linux Status: NEW Keywords: regression Severity: normal Priority: P2 Component: dsound Assignee: wine-bugs(a)list.winehq.org Reporter: gyebro69(a)gmail.com CC: jonkoops(a)gmail.com Regression SHA1: ebc31cfbeef9b1079685b1ef8b281a7b02072119 Distribution: --- Created attachment 81141 --> http://bugs.winehq.org/attachment.cgi?id=81141 terminal output This was tested with GOG.version. Can't reproduce with the original demo version. The game crashes on start just when the first intro movie should be started. Disabling the intro movie by starting the game with /NOMOVIES option works around the crash. Bisected to commit ebc31cfbeef9b1079685b1ef8b281a7b02072119 dsound: Create independent devices for each DirectSoundCreate call. Can't revert the patch but the game starts properly with the previous commit. Let me know what debug log would be useful. wine-11.10-181-g71958c63809 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 6

[Bug 59561] New: VICE: GTK version of x86sc.exe crashes at startup.
by WineHQ Bugzilla Sept. 11, 2026

Sept. 11, 2026

http://bugs.winehq.org/show_bug.cgi?id=59561 Bug ID: 59561 Summary: VICE: GTK version of x86sc.exe crashes at startup. Product: Wine Version: 11.4 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)list.winehq.org Reporter: bernhardu(a)mailbox.org Distribution: --- Created attachment 80616 --> http://bugs.winehq.org/attachment.cgi?id=80616 vice_gtk_3.10_winehq-11.4_backtrace.txt https://sourceforge.net/projects/vice-emu/files/releases/binaries/windows/G… Maybe related logging immediately before the crash: fixme:dxgi:DXGID3D10CreateDevice Ignoring flags 0x20. fixme:d3d:wined3d_swapchain_init The application requested more than one back buffer, this is not properly supported. Please configure the application to use double buffering (1 back buffer) if possible. ... fixme:d3d11:d3d11_device_context_SwapDeviceContextState D3D10 interface emulation not fully implemented yet! It crashes with following Backtrace: =>0 ID2D1Image_AddRef() [include/d2d1.h:3254] in d2d1 1 d2d_effect_SetInput+0x21() [dlls/d2d1/effect.c:2805] in d2d1 2 0x0000014022e58a in x64sc Unfortunately upstream builds are stripped so lacking debug information. But I guess following location is calling this SetInput with the context->render_bitmap being a NULL pointer: https://github.com/VICE-Team/svn-mirror/blob/main/vice/src/arch/gtk3/direct… (The SDL version from SDL2VICE-3.10-win64.zip seems to work find.) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 18

[Bug 54836] New: GrandMA3 onPC Version 1.9.2.2 page fault on startup (1.8.8.2 worked fine)
by WineHQ Bugzilla Sept. 11, 2026

Sept. 11, 2026

https://bugs.winehq.org/show_bug.cgi?id=54836 Bug ID: 54836 Summary: GrandMA3 onPC Version 1.9.2.2 page fault on startup (1.8.8.2 worked fine) Product: Wine Version: 8.5 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: wintrust Assignee: wine-bugs(a)winehq.org Reporter: nikolaus.einhauser(a)web.de Distribution: --- So MALighting just released their new "major" update (new features, breaking old ones, etc) to their software which broke compatability with wine. Their previous version worked fine. The issue can easily be reproduced by installing the software and then starting `app_gma3.exe`. It will crash on startup. Judging by `wine: Unhandled page fault on execute access to 000000000000000F at address 000000000000000F (thread 010c)`, the problem seems to be in the application. By inspecting the `+relay` log a little closer the page fault only looks like a symptom of missing error handling. From what I can tell, the issue lies in wintrust.WinVerifyTrust but feel free to look trough the attached debug log yourself. I'd very glad to provide more in-depth debug info or help otherwise to aid in fixing this. Suggestions for workarounds are also appreciated. Thank you. PS. There is a contest currently ongoing that mandates the use of version 1.9 or higher. So staying on an older previously working version is not an option for me. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 16

[Bug 58192] New: dozen Vulkan driver fails due to missing/minimal dxcore implementation (both MacOS and Linux)..
by WineHQ Bugzilla Sept. 11, 2026

Sept. 11, 2026

http://bugs.winehq.org/show_bug.cgi?id=58192 Bug ID: 58192 Summary: dozen Vulkan driver fails due to missing/minimal dxcore implementation (both MacOS and Linux).. Product: Wine Version: 10.6 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: rtfss1(a)gmail.com Distribution: --- Hi, in brief my request expand dxcore.dll support in Wine to a minimal dxcore implementation that allows to run Dozen via Wine.. on both Macos and Linux.. on MacOS for Dozen+D3DMetal testing on Linux for Dozen+VKD3D testing.. details: just wanting to test Dozen (Mesa Vulkan over D3D12 library) in Macos with Crossover 25.0 (bottle setup to using D3DMetal 2.1 as D3D12 driver).. for that I just download: mesa3d-25.0.4-release-msvc.7z from: https://github.com/pal1000/mesa-dist-win/releases/tag/25.0.4 and then adjust ICD loader to find the vulkan_dzn.dll driver and run vulkaninfo.exe.. I check I have all enviroment correctly as also extract lavapipe Vulkan driver from that package and it works correctly with vulkaninfo.exe using dozen on Crossover 25.0 (setup to use D3DMetal 2.1) I see bug that is not related to D3DMetal D3D12 driver: MESA: error: Failed to retrieve D3D12GetInterface MESA: error: Failed to create DXCore adapter factory so would fail also on Linux.. seeing Dozen source code I find in: https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/src/microsoft/vulkan/d… fails in dzn_enumerate_physical_devices_dxcore function.. code below.. that is using dxcore and fails with DXCoreCreateAdapterFactory being a stub currently: https://github.com/wine-mirror/wine/blob/master/dlls/dxcore/main.c perhaps it's better to use as reference if wanting to implement dxcore Wine support checking it works with a minimal sample provided "Minimal DXCore application": https://github.com/MicrosoftDocs/win32/blob/docs/desktop-src/dxcore/dxcore-… dxcore microsoft docs: https://learn.microsoft.com/en-us/windows/win32/dxcore/dxcore-enum-adapters dxcore seems the "future" to enumerate adapters on Windows due to enumeration possibly NPU devices also.. dozen source code where it fails: util_dl_library *dxcore = util_dl_open(UTIL_DL_PREFIX "dxcore" UTIL_DL_EXT); if (!dxcore) { mesa_loge("Failed to load DXCore\n"); return VK_ERROR_INITIALIZATION_FAILED; } using PFNDXCoreCreateAdapterFactory = HRESULT (APIENTRY*)(REFIID, void **); PFNDXCoreCreateAdapterFactory create_func = (PFNDXCoreCreateAdapterFactory)util_dl_get_proc_address(dxcore, "DXCoreCreateAdapterFactory"); if (!create_func) { mesa_loge("Failed to load DXCoreCreateAdapterFactory\n"); return VK_ERROR_INITIALIZATION_FAILED; } IDXCoreAdapterFactory *factory; if (FAILED(create_func(IID_PPV_ARGS(&factory)))) { mesa_loge("Failed to create DXCore adapter factory\n"); return VK_ERROR_INITIALIZATION_FAILED; } -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 1

[Bug 59407] New: Multiple apps require appx/appxbundle support to install
by WineHQ Bugzilla Sept. 10, 2026

Sept. 10, 2026

http://bugs.winehq.org/show_bug.cgi?id=59407 Bug ID: 59407 Summary: Multiple apps require appx/appxbundle support to install Product: Wine Version: 11.2 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: msi Assignee: wine-bugs(a)list.winehq.org Reporter: asdfghrbljzmkd(a)outlook.com Distribution: --- An easy example is this app: https://downloads.thehomeremote.com/designer/HomeRemote.Designer.Package_4.… As per https://forum.winehq.org/viewtopic.php?t=37861 the app can run if manually extracted, but Wine itself currently has no capability to install msixbundle packages. Some Adobe Creative Cloud applications (at least Adobe Express Photos and Adobe Fresco) need appxbundle support to install. Currently they crash earlier in the process due to a missing PackageFullNameFromId implementation, but when including the implementation from Proton, they fail to install the appxbundle. See https://bugs.winehq.org/show_bug.cgi?id=59278 for details (including Adobe Installer logs showing to trying and failing to install an appxbundle). Interestingly, Microsoft has released some appx code as MIT (https://github.com/microsoft/msix-packaging) Perhaps this code could be integrated into Wine in order to provide appx/appxbundle installation capabilities? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 5

[Bug 59991] New: ntdll-ForceBottomUpAlloc: MEM_TOP_DOWN allocations can return addresses above the user address limit
by WineHQ Bugzilla Sept. 10, 2026

Sept. 10, 2026

http://bugs.winehq.org/show_bug.cgi?id=59991 Bug ID: 59991 Summary: ntdll-ForceBottomUpAlloc: MEM_TOP_DOWN allocations can return addresses above the user address limit Product: Wine-staging Version: 11.12 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)list.winehq.org Reporter: iviv(a)etersoft.ru CC: leslie_alistair(a)hotmail.com, z.figura12(a)gmail.com Target Milestone: --- Distribution: --- Created attachment 81394 --> http://bugs.winehq.org/attachment.cgi?id=81394 Suggested fix Expected behavior: Top-down allocation should either return a valid address range below lpMaximumApplicationAddress or fail with a Windows-compatible status code. Actual behavior: Wine returns STATUS_SUCCESS with an address range above lpMaximumApplicationAddress. Error occurs after applying patches from https://gitlab.winehq.org/wine/wine-staging/-/blob/master/patches/ntdll-For… 32-bit applications can receive top-down allocations above the process user address limit. I used an app that shows an error on exit: Application made attempt to free invalid or unknown memory block: $FFFF00E0 The problem appears when a 32-bit process uses top-down virtual memory allocation. Wine may return an address above max, for example, in a 32-bit process: MaxAppAddress = 7ffeffff NtAllocateVirtualMemory(... MEM_TOP_DOWN ...) = 7fff0000 The returned address range is outside the valid user address range. VirtualQuery() does not recognize the returned address, but NtAllocateVirtualMemory still reports STATUS_SUCCESS. Native Windows does not return such addresses. I am attaching an example of a fix that works for me. It comes down to setting address limit via get_wow_user_space_limit() when wow64 is used. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 4