Esme Povirk (@madewokherd) commented about dlls/mscoree/metahost.c:
ret = get_mono_path_dos( dos_dir, path);
- heap_free(dos_dir);
- free(dos_dir);
This looks wrong. The result of wine_get_dos_file_name is still heap-allocated, and I think it has to remain that way since kernel32 doesn't use ucrtbase.