'iret' path hit in wine_syscall_dispatcher in the game is due to instrumentation callback
Thanks for clarifying.
Having NT flag set for the machine frame iret restores to is fine in terms that it doesn't fault now (your test shows that).
Right. I also realize that I was making an incorrect assumption that the problem is the NT flag is in the machine frame that iret restores *to*; in fact, as you say, iret faults when the *current* EFLAGS.NT is 1.