http://bugs.winehq.org/show_bug.cgi?id=15847
--- Comment #1 from Rob Shearman robertshearman@gmail.com 2008-10-30 08:49:13 --- This is a bug in Windows' version of rpcrt4.dll. I forget the details, but it is caused by something like the code executed as part of NdrVaryingArrayUnmarshall not setting a variable (possibly MIDL_STUB_MESSAGE::ActualCount) before calling NdrpEmbeddedPointerUnmarshall and so reads off the end of the array.