https://bugs.winehq.org/show_bug.cgi?id=52819
--- Comment #3 from Zeb Figura z.figura12@gmail.com --- (In reply to Zeb Figura from comment #2)
Best I can imagine is that maybe rpcrt4 doesn't marshal [in] pointers in-process.
This doesn't seem to be true in general, and it wouldn't help anyway, because what's getting double-freed is the safe array pointer itself.