http://bugs.winehq.org/show_bug.cgi?id=29663
--- Comment #11 from Stefan Dösinger stefan@codeweavers.com 2013-01-06 16:06:13 CST --- I was able to reproduce this on a i965 GPU. The game expects buffer::map() to always return the same pointer. The bug has some similarities to Bug 18799. In the case of Crysis an argument could be made that a D3DPOOL_MANAGED buffer can be expected to stay at one address, but Rayman 3 expects this behavior from a dynamic buffer.
I guess it is up to the somewhat random memory layout what the results of the invalid memory access are. On my main system nothing bad happens. On my i965 system I get the beeping sound described in this bug. If I disable VBOs entirely and randomize the address returned from buffer::map(), I get the beeping sound on my Nvidia system as well, while apparently the full version of the game just crashes.
I tested the demo on one Windows machine(r700 GPU, Core i7, Windows 7), and it is working fine there. I suspect this is because of a lucky memory layout, but there might also be a hack in the graphics driver or some other mechanism that makes it work.