Now I traced the problem down to: dlls/wined3d/surface.c d3dfmt_convert_surface
loops over the surface height and width, the only problem is that the surface height appears to be scaled up to the next power of 2.
As carmageddon runs in 320x200 the loop tries to iterate over 320x256 and subsequently crashes with a page fault in winedbg.
Sounds like that the surface conversion code still makes some assumptions about the allocated memory size and the surface size. Wine used to allocate the full power of 2 size, but I removed that and allocate only the real surface size because there are some applications which expected a specific pitch for the surface. The power of 2 size usage vs real size was pretty inconsistent, I guess there is another inconsistency.