In case anyone wishes to note or fix them, here are five functions that are being called with a NULL parameter that they cannot yet properly handle, and which they are passing down to a str...() or mem...() function. I may be wrong, but I don't think these have been caught by Coverity. The number in the brackets is, of course, the parameter affected.
advapi/security.c:LookupPrivilegeNameW(3)
dbghelp/stabs.c:stabs_pts_read_type_def(2)
gdi/freetype.c:WineEngGetOutlineTextMetrics(3)
msi/table:get_tablecolumns(3)
setupapi/devinst.c:SetupDiGetDeviceInstanceIdW(3)
Cheers,