Handling page faults in syscalls

I just had a bit of a frustrating moment debugging why winecfg was =
crashing in my freshly built tree, and discovered something that many of =
you probably already know but is new to me: Wine swallows page faults =
that happen inside a syscall and just unwinds the stack to the caller =
returning an error, with only a trace level log.

This seems surprising - normally page faults indicate a bug and need to =
be reported. And also scary - the code behind the syscall boundary can =
be anything, not necessarily part of the wine project, possibly even =
platform libc, and therefore not safe to unwind.

My guess is these are caught instead of killing the process because =
that's the expected behavior of an NT syscall when you pass a bad =
pointer to it - that a bad dereference of a userspace pointer would be =
handled and turned into returning an fault error code. Is this right? =
But then what would actually make sense is to write separate functions =
for safely dereferencing user pointers, like Linux has.

What should ideally be happening here?

~Theodore=