http://bugs.winehq.org/show_bug.cgi?id=18575
--- Comment #9 from Nikolay Sivov bunglehead@gmail.com 2010-05-09 19:22:46 --- Server returns STATUS_OBJECT_TYPE_MISMATCH for passed handle created for HKCR. After some tracing this handle is event handle actually, not a hkey one.
This is what happens:
--- 0009:trace:reg:get_special_root_hkey hkey 0x80000000 0009:trace:reg:NtCreateKey ((nil),L"Machine\Software\Classes",<null>,0,2000000,0x33f448) create_key exit 0x00000000, parent 0x809e6a8, req->parent 0 0009:trace:reg:NtCreateKey <- 0x4 0009:trace:reg:create_key 1: 0x00000000 0009:trace:reg:create_special_root_hkey L"Machine\Software\Classes" -> 0x4 0009:trace:reg:get_special_root_hkey return 0x4 <- ... 0009:trace:ntdll:NtClose 0x4 0009:trace:ntdll:NtCreateEvent event created 0x4 0009:trace:ntdll:NtCreateEvent event created 0x8 0009:trace:ntdll:NtCreateEvent event created 0x10 0009:trace:ntdll:NtCreateEvent event created 0x48 0009:trace:ntdll:NtCreateEvent event created 0x50 0009:trace:ntdll:NtCreateEvent event created 0x58 0009:trace:reg:RegCreateKeyExA 0x80000000 CLSID{E5A1691B-D188-4419-AD02-90002030B8EE} 0 2001f 0x33fb88 0009:trace:reg:get_special_root_hkey hkey 0x80000000 0009:trace:reg:get_special_root_hkey return 0x4 <- 0009:trace:reg:NtCreateKey (0x4,L"CLSID\{E5A1691B-D188-4419-AD02-90002030B8EE}",L"",0,2001f,0x33fb88) 0009:trace:reg:NtCreateKey <- 0x1590b08 0009:trace:reg:create_key 1: 0xc0000024 0009:trace:reg:RegCreateKeyExA ntstatus 0xc0000024 ---
First time cached handle for HKCR special 0x80000000 is created with value 0x4. After that it's closed with NtClose() but remains in advapi32 cache as 0x4. Thread creates an event object then which got free handle with 0x4 value. On next call to RegCreateKeyExA() it's used in place of HKCR. This caused handle type mismatch on server side (and it's true of course), and an error code returned.