Recover the typed font-cache image pointer chain in both builds
Both native font caches store IMAGE_LoadDC6 results at record+0 and pass that value to IMAGE_FreeImage; the existing pFontDC6 member is still void*. Retype it to existing DC6* in both builds. Mac0043209c holds the address of that slot, not the image itself: type it DC6** and recover Windows00841d88's chosen gppDC6FontCache name. Both Mac writers and all four readers agree on this indirection. Record size20, field width4, chosen field names and other fields remain unchanged. Pending1366 concerns the Mac array's extent/name, not these member/global contracts.
Changes 4, applied together
Struct field
win /D2FontCacheEntryStrc + 0x0typevoid *→DC6 *Struct field
mac /D2FontCacheEntryStrc + 0x0typevoid *→DC6 *Retype global
mac 0x0043209ctypeundefined4 (4 bytes)→DC6 * *Rename global
mac 0x0043209cnameDAT_0043209c→gppDC6FontCache