I think I'm closer now...
trace:ddraw:User_DirectDraw_Construct (0x403a7c70,0)
Program received signal SIGINT, Interrupt. [Switching to Thread 16384 (LWP 2877)] 0x40f510e4 in DDRAW_Create (lpGUID=0x0, lplpDD=0x40c92d38, pUnkOuter=0x0, iid=0x40f585d0, ex=0) at main.c:264 264 while(1); (gdb) print pDD $1 = (struct IDirectDraw7 *) 0x403a7c70 (gdb) print *pDD $2 = {lpVtbl = 0x40f5a960} (gdb) print *pDD->lpVtbl $3 = {dummyRTTI1 = 1089756760, dummyRTTI2 = 1089756316, QueryInterface = 0x40f45cf0 <Main_DirectDraw_Release>, AddRef = 0x40f45f8c <Main_DirectDraw_Compact>, Release = 0x40f45fd4 <Main_DirectDraw_CreateClipper>,
So the create function is apparently unaware of the dummy values and is filling them in regardless... more later...