http://bugs.winehq.org/show_bug.cgi?id=25057
--- Comment #8 from Marcus Meissner marcus@jet.franken.de 2010-11-08 03:02:51 CST --- it seems to VirtualQuery() first address of kernel32.dll (the PE header) and act on that.
this might be one of the border condotions.