http://bugs.winehq.org/show_bug.cgi?id=12044
--- Comment #40 from Sam Edwards CFSworks@gmail.com 2012-02-21 19:45:56 CST --- I'm now 90% certain that this is the same as bug 7698...
Turning on Windows 98 mode fixed the problem. After a little reverse-engineering, I found that Source uses GetGlyphOutlineA where available, and falls back to ExtTextOutA when GetGlyphOutlineA fails. I turned Windows 98 mode back off and modified GetGlyphOutline* to return GDI_ERROR unconditionally, and the crash went away!
The difference between this and bug 7698 is that this crash occurs immediately, while 7698 takes some time before it dies. My explanation for this is that Garry's Mod renders its killicons from a Lua function, and so the call stack is far different from pure-Source, and Garry's Mod's stack is far more sensitive to buffer overflows while rendering a font glyph. When this happens in other games, it probably just corrupts a little bit of memory each time until the game finally crashes.
I'm going to try loading some Counter-Strike Source killicons in GMod and see which ones cause crashes. We should then know for sure if my guess is correct.
If anybody wants to help reverse-engineer this, the culprit function is located in vguimatsurface.dll. Look for the subroutine that calls GetGlyphOutlineA (there is only one). For me the entry point is located at 0x1001A7B0.