http://bugs.winehq.org/show_bug.cgi?id=21962
--- Comment #39 from Stefan Dösinger stefandoesinger@gmx.at 2010-04-02 04:24:17 --- It is crashing inside the draw call. And the bad address was provided from a vertex buffer:
0009:trace:d3d:buffer_Map Returning memory at 0x52b09000 (base 0x52b09000, offset 0)
It starts to make sense that the patch that avoids the non-vbo fallback fixes the crash. If there's a bad vbo the driver is more likely to just not draw stuff instead of crashing. I still have to figure out why the buffer's memory isn't there.