diff --git a/dlls/ntdll/sync.c b/dlls/ntdll/sync.c
index ecfe6f7b09c..ba8d65b8958 100644
--- a/dlls/ntdll/sync.c
+++ b/dlls/ntdll/sync.c
@@ -1007,16 +1007,16 @@ static BOOL invoke_apc( const apc_call_t *call, apc_result_t *result )
         HANDLE handle;
         SIZE_T reserve = call->create_thread.reserve;
         SIZE_T commit = call->create_thread.commit;
+        void *func = wine_server_get_ptr( call->create_thread.func );
+        void *arg  = wine_server_get_ptr( call->create_thread.arg );
 
         result->type = call->type;
-        if (reserve == call->create_thread.reserve && commit == call->create_thread.commit)
+        if (reserve == call->create_thread.reserve && commit == call->create_thread.commit &&
+            (ULONG_PTR)func == call->create_thread.func && (ULONG_PTR)arg == call->create_thread.arg)
         {
             result->create_thread.status = RtlCreateUserThread( NtCurrentProcess(), NULL,
                                                                 call->create_thread.suspend, NULL,
-                                                                reserve, commit,
-                                                                call->create_thread.func,
-                                                                call->create_thread.arg,
-                                                                &handle, &id );
+                                                                reserve, commit, func, arg, &handle, &id );
             result->create_thread.handle = wine_server_obj_handle( handle );
             result->create_thread.tid = HandleToULong(id.UniqueThread);
         }
diff --git a/dlls/ntdll/thread.c b/dlls/ntdll/thread.c
index b1647277266..a79bdf33668 100644
--- a/dlls/ntdll/thread.c
+++ b/dlls/ntdll/thread.c
@@ -483,8 +483,8 @@ NTSTATUS WINAPI RtlCreateUserThread( HANDLE process, const SECURITY_DESCRIPTOR *
         memset( &call, 0, sizeof(call) );
 
         call.create_thread.type    = APC_CREATE_THREAD;
-        call.create_thread.func    = start;
-        call.create_thread.arg     = param;
+        call.create_thread.func    = wine_server_client_ptr( start );
+        call.create_thread.arg     = wine_server_client_ptr( param );
         call.create_thread.reserve = stack_reserve;
         call.create_thread.commit  = stack_commit;
         call.create_thread.suspend = suspended;
diff --git a/include/wine/server_protocol.h b/include/wine/server_protocol.h
index 6e60dab6699..521f7275413 100644
--- a/include/wine/server_protocol.h
+++ b/include/wine/server_protocol.h
@@ -362,11 +362,11 @@ typedef union
     struct
     {
         enum apc_type    type;
-        void (__stdcall *func)(void*);
-        void            *arg;
+        int              suspend;
+        client_ptr_t     func;
+        client_ptr_t     arg;
         mem_size_t       reserve;
         mem_size_t       commit;
-        int              suspend;
     } create_thread;
 } apc_call_t;
 
@@ -5059,6 +5059,6 @@ union generic_reply
     struct set_window_layered_info_reply set_window_layered_info_reply;
 };
 
-#define SERVER_PROTOCOL_VERSION 369
+#define SERVER_PROTOCOL_VERSION 370
 
 #endif /* __WINE_WINE_SERVER_PROTOCOL_H */
diff --git a/server/protocol.def b/server/protocol.def
index 966e9004101..62717a5fa32 100644
--- a/server/protocol.def
+++ b/server/protocol.def
@@ -378,11 +378,11 @@ typedef union
     struct
     {
         enum apc_type    type;      /* APC_CREATE_THREAD */
-        void (__stdcall *func)(void*);  /* start function */
-        void            *arg;       /* argument for start function */
+        int              suspend;   /* suspended thread? */
+        client_ptr_t     func;      /* void (__stdcall *func)(void*);  start function */
+        client_ptr_t     arg;       /* argument for start function */
         mem_size_t       reserve;   /* reserve size for thread stack */
         mem_size_t       commit;    /* commit size for thread stack */
-        int              suspend;   /* suspended thread? */
     } create_thread;
 } apc_call_t;
 
diff --git a/server/trace.c b/server/trace.c
index 9954efd0201..d2a7cec7507 100644
--- a/server/trace.c
+++ b/server/trace.c
@@ -193,8 +193,11 @@ static void dump_apc_call( const apc_call_t *call )
         dump_uint64( &call->unmap_view.addr );
         break;
     case APC_CREATE_THREAD:
-        fprintf( stderr, "APC_CREATE_THREAD,func=%p,arg=%p,reserve=",
-                 call->create_thread.func, call->create_thread.arg );
+        fprintf( stderr, "APC_CREATE_THREAD,func=" );
+        dump_uint64( &call->create_thread.func );
+        fprintf( stderr, ",arg=" );
+        dump_uint64( &call->create_thread.arg );
+        fprintf( stderr, ",reserve=" );
         dump_uint64( &call->create_thread.reserve );
         fprintf( stderr, ",commit=" );
         dump_uint64( &call->create_thread.commit );