https://bugs.winehq.org/show_bug.cgi?id=48665
--- Comment #2 from Andrew Wesie awesie@gmail.com --- Confirmed the issue. It is a known limitation that is annoying to handle correctly in Wine.
When a DLL is mapped in to memory, its data section should be mapped as PAGE_WRITECOPY and this memory should be reported as "Shared" by QueryWorkingSetEx. Once a page is modified, that page should become mapped as PAGE_READWRITE and reported as not shared.
Wine does not handle this correctly. Wine maps PROT_WRITECOPY as a private mapping (instead of a shared mapping) and does not update the mapping protection to PROT_READWRITE.
Provided we do not want to modify the Linux kernel, the correct way to handle this is probably to map the memory read only, then handle the fault by mapping it as PAGE_READWRITE. Unfortunately, this may harm start-up performance due to the extra page faults.