I don't have a great high level understanding of how this all works, so apologies if I'm covering uninteresting paths (or skipping over relevant parts). But what I can see happening is that the surface is being created as a part of a call to `NtUserSetWindowPos` in one thread, and then another thread calls `NtUserPeekMessage` (which results in a call to `flush_window_surfaces`). **NtUserSetWindowPos** `set_window_pos` (called by `NtUserSetWindowPos`) calls `get_window_surface` and then `apply_window_pos`: - `get_window_surface` results in the creation of the `ximage` with the `data` field pointing to the `malloc` data in question; and then - `apply_window_pos` calls `register_window_surface` which puts the `window_surface` in the `window_surfaces` list. The `windows_surface` has `color_bitmap` set to a GDI handle (a `HBITMAP`). That handle is ultimately a `BITMAPOBJ` which has `dib.dsBm.bmBits` pointing to the data from the `malloc`. **NtUserPeekMessage** When `flush_window_surfaces` is called, it iterates the `window_surfaces` list and passes this `window_surface` to `window_surface_flush`. `window_surface_flush` calls `window_surface_get_color`. `window_surface_get_color` (via the `surface->color_bitmap` GDI handle) returns a pointer to the `malloc` data. `window_surface_get_color` assigns this to `color_bits` and then passes it to `x11drv_surface_flush`. Within `x11drv_surface_flush`, `color_bits` is assigned to `src`, and `ximage->data` is assigned to `dst`. These both point to the data from the `malloc`, so only the alpha bits are updated. After that, the `XPutImage` function is called, with the RGB data from the `malloc` uninitialised. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/10356#note_132582