https://bugs.winehq.org/show_bug.cgi?id=40024
--- Comment #4 from Andrew Eikum aeikum@codeweavers.com --- To elaborate a bit more, the application calls midiOutPrepareHeader, which allocates a 32-bit backing header. Then the application calls MODM_LONGDATA with that header, so mmsystem16 maps the header to the backing header and invokes 32-bit winmm. Eventually this calls the application's MOM_DONE callback with that header. The application calls midiOutUnprepareHeader during this callback, which frees the 32-bit backing header. After the callback is done, the LONGDATA call unmaps its 32-bit header, but this was deleted by the UnprepareHeader call, and the application crashes.