I played a bit with smatch and Wine (after reading http://people.redhat.com/mstefani/wine/smatch/), to try to get over what I mentionned in my last email (regarding winapi_check and cross-calls in parenthesis).
I attach the smatch script to generate the results I have. It's still not perfect (the listview.c references are wrong, for example), but as it's tied to gcc it can detect some calls which otherwise would not be caught. For example, the calls to GetWindowLongA in header.c are in a macro.
Not all of them are bugs: caution is needed when checking, although reducing the number of false positive would likely be welcome (either by modifying the script or patches).
Vincent