https://bugs.winehq.org/show_bug.cgi?id=53682
--- Comment #1 from Kevin Puetz PuetzKevinA@JohnDeere.com --- Oh, I guess I should explain how this leads to that "BUG: holding USER lock".
After we SEGV on the bad return address, this gets translated into SEH, and then swallowed by the syscall wrapper, and then rundll continues on. Next CreateWindow call balks on the lock still held by the one that didn't finish or unwind correctly (because it crashed on this tangled mess of return addresses)