which locks th->data->cs, a CRITICAL_SECTION which is initialized only in the thread_fn, so it finds garbage.
Attached patch initializes it before calling _beginthreadex. GDB/windbg probably start newly created threads sooner, because this doesn't happen under a debugger.
With the patch below it boots until it crashes somewhere while attaching disks (-hda raw_img).
"bt" in gdb only returns "#0 0x00000000 in ??" and generate-core-file didn't work.