http://bugs.winehq.org/show_bug.cgi?id=11793
--- Comment #5 from Saulius K. saulius2@gmail.com 2008-03-04 00:06:22 --- One idea of where does 0x18 pointer value come from is dereferencing pointer (to some struct) which has NULL value and then using ptr to smaller, embedded struct DS3DBUFFER.
Maybe +relay trace (at least ~3000 lines before "wine: Unhandled page fault...") would suffice for successful investigation? Well, +snoop info may be needed also, but I am not so sure.