It keeps crashing when I try to exit the sewers. If the sound driver is enabled, it will enter my now familiar endless loop in call_exception_handler() (see sam and max season 1). Otherwise it just crashes (Exit code 5).
Since it would crash in the exception handler, I grepped out all the trace of exceptions from a trace +all run.
000d:trace:seh:raise_exception info[0]=00000000
000d:trace:seh:raise_exception info[1]=ffffffff
000d:trace:seh:raise_exception eax=00000000 ebx=501026fb ecx=ffffffff edx=ffffffff esi=0034f880 edi=ffffffff
000d:trace:seh:raise_exception ebp=0034f748 esp=0034f710 cs=0017 ds=001f es=001f fs=1007 gs=0037 flags=00010246
000b:Call kernel32.RaiseException(406d1388,00000000,00000004,0034f7a8) ret=00747890
000b:trace:seh:raise_exception code=406d1388 flags=0 addr=0x7b82e174
000b:trace:seh:raise_exception info[0]=00001000
000b:trace:seh:raise_exception info[1]=00a2fc44
000b:trace:seh:raise_exception info[2]=0000000b
000b:trace:seh:raise_exception info[3]=00000000
000b:trace:seh:raise_exception eax=7b818c45 ebx=7b82e18c ecx=00000000 edx=00000000 esi=00000004 edi=0034f6e0
000b:trace:seh:raise_exception ebp=0034f6b8 esp=0034f644 cs=0017 ds=001f es=001f fs=1007 gs=0037 flags=00000246
000b:Ret kernel32.RaiseException() retval=7b818c45 ret=00747890
000b:Call kernel32.RaiseException(406d1388,00000000,00000004,0034f7c0) ret=00747890
000b:trace:seh:raise_exception code=406d1388 flags=0 addr=0x7b82e174
000b:trace:seh:raise_exception info[0]=00001000
000b:trace:seh:raise_exception info[1]=00a31a00
000b:trace:seh:raise_exception info[2]=00000010
000b:trace:seh:raise_exception info[3]=00000000
000b:trace:seh:raise_exception eax=7b818c45 ebx=7b82e18c ecx=00000000 edx=00000000 esi=00000004 edi=0034f6f0
000b:trace:seh:raise_exception ebp=0034f6c8 esp=0034f654 cs=0017 ds=001f es=001f fs=1007 gs=0037 flags=00000246
000b:Ret kernel32.RaiseException() retval=7b818c45 ret=00747890
000b:trace:seh:raise_exception code=c0000005 flags=0 addr=0x49a719
000b:trace:seh:raise_exception info[0]=00000001
000b:trace:seh:raise_exception info[1]=00000072
000b:trace:seh:raise_exception eax=00000000 ebx=2a009960 ecx=00000005 edx=1d0049a0 esi=00000000 edi=00000000
000b:trace:seh:raise_exception ebp=00000000 esp=0034f1f4 cs=0017 ds=001f es=001f fs=1007 gs=0037 flags=00010293
000b:Call kernel32.UnhandledExceptionFilter(0034ed24) ret=0098d979
0014: wait_debug_event() = 0 { pid=000a, tid=000b, wait=0x0, event={exception,{code=80000003,flags=0,rec=0x0,addr=0x942522e9,params={},first=1} }
000b:Ret kernel32.UnhandledExceptionFilter() retval=00000000 ret=0098d979
000b: queue_exception_event( first=0, record={context={flags=0001001f,eax=00000000,ebx=2a009960,ecx=00000005,edx=1d0049a0,esi=00000000,edi=00000000,ebp=00000000,eip=0049a719,esp=0034f1f4,eflags=00010293,cs=0017,ds=001f,es=001f,fs=1007,gs=0037,dr0=00000000,dr1=00000000,dr2=00000000,dr3=00000000,dr6=00000000,dr7=00000000,float={ffff037f,ffff0000,ffffffff,00000000,00000000,00000000,ffff0000,00000000,80000000,00003ff4,00000000,3ff48000,00000000,80000000,0000bfff,00000000,00000000,00000000,80000000,00004007,00000000,3fff8000,00000000,c3500000,00004010,00000000,4010c34b,00000000}},rec={code=c0000005,flags=0,rec=0x0,addr=0x49a719,params={1,72}} )
000b: queue_exception_event() = 0 { handle=0xec }
0014: wait_debug_event() = 0 { pid=000a, tid=000b, wait=0x0, event={exception,{code=c0000005,flags=0,rec=0x0,addr=0x49a719,params={1,72},first=0} }
Unhandled exception: page fault on write access to 0x00000072 in 32-bit code (0x0049a719).
000b: get_exception_status( handle=0xec )
000b: get_exception_status() = 10002 { context={flags=0001001f,eax=00000000,ebx=2a009960,ecx=00000005,edx=1d0049a0,esi=00000000,edi=00000000,ebp=00000000,eip=0049a719,esp=0034f1f4,eflags=00010293,cs=0017,ds=001f,es=001f,fs=1007,gs=0037,dr0=00000000,dr1=00000000,dr2=00000000,dr3=00000000,dr6=00000000,dr7=00000000,float={ffff037f,ffff0000,ffffffff,00000000,00000000,00000000,ffff0000,00000000,80000000,00003ff4,00000000,3ff48000,00000000,80000000,0000bfff,00000000,00000000,00000000,80000000,00004007,00000000,3fff8000,00000000,c3500000,00004010,00000000,4010c34b,00000000}} }
000b:trace:seh:raise_exception code=c0000005 flags=0 addr=0x49a719
000b:trace:seh:raise_exception info[0]=00000001
000b:trace:seh:raise_exception info[1]=00000072
000b:trace:seh:raise_exception eax=00000000 ebx=2a009960 ecx=00000005 edx=1d0049a0 esi=00000000 edi=00000000
000b:trace:seh:raise_exception ebp=00000000 esp=0034f1f4 cs=0017 ds=001f es=001f fs=1007 gs=0037 flags=00010293
000b:Call kernel32.UnhandledExceptionFilter(0034ed24) ret=0098d979
000b:Ret kernel32.UnhandledExceptionFilter() retval=00000001 ret=0098d979
000b:Call kernel32.SetUnhandledExceptionFilter(521bc2c0) ret=009928a9
000b:Ret kernel32.SetUnhandledExceptionFilter() retval=00992800 ret=009928a9
000b:Call kernel32.SetUnhandledExceptionFilter(00000000) ret=521bc447
000b:Ret kernel32.SetUnhandledExceptionFilter() retval=521bc2c0 ret=521bc447