The only call to the ReadWriteDR2 function I found in the disassembler output is a read call, and the DR2 value is compared with 0xffb31146. Hope this helps.
well, not really DR0..3 contain the linear address where you want to put your breakpoint... so there's no reason it's updated by the 0 fault, however is DR2 set by hand before the call to the function similary is DR7 set in the nearby (this is the register that enables/disables among other things, the use of the addresses stored in the DR0..3 regs)
A+