I updated the wiki about this. We Are doing it wrong if any of the

three pointers point at the BASEOBJECT of the handle structure and not
at "+0x10" SURFOBJ surfobj.....

pdc->dclevel.pSurface;
pdc->pSurfInfo;
ppdev->pSurface;

typedef struct _SURFACE
{                            // Win XP
    BASEOBJECT BaseObject;   // 0x000
    SURFOBJ    surfobj;      // 0x010 <---- above three pointers are set here!
    XDCOBJ *   pdcoAA;       // 0x044
    FLONG      flags;        // 0x048
......
......