Thanks for the input, usually I don't doubt the correctness of the headers. I made a few tests with testbot and compared the content of the returned DEBUG_BUFFER. Based on this I modified the structure to get wine return the pointer at the same offset like windows.
v2: - Rebased to current git. - Modify structure DEBUG_BUFFER to match for 64-Bit. - No longer doing functional change to RtlQueryProcessDebugInformation.