Hi, Well, I've made pretty good progress, but am a bit stuck with this problem. Basically: 003d:trace:ole:TL_Marshal parameter 1 003d:trace:ole:TL_Marshal name : L"rgszNames" 003d:trace:ole:TL_Marshal type : 26 003d:trace:ole:TL_Marshal flags : 01 003d:trace:ole:TL_MarshalType dereferencing PTR 0x52edf7d0 => 0x54331260 003d:trace:ole:TL_MarshalType dereferencing PTR 0x54331260 => 0x54331270 003d:trace:ole:TL_MarshalType marshaling byte 100 As you can see, it's marshalling IDispatch across apartment boundaries, but it gets this parameter wrong. The double dereference seems correct, but marshalling a byte is not - I think it should be a BSTR. rgszNames is a parameter of IDispatch::GetIDsFromNames, which is defined as an OLECHAR FAR* FAR* I can't figure out where the typeinfo data for IDispatch is coming from though, hence my stuckness. BTW, is this line really correct: TL_Unmarshal(pStm, pInfo, pDesc, PARAMFLAG_FIN, args, &argc, pChannel, &is_iid); shouldn't it be: TL_Unmarshal(pStm, pInfo, pDesc, PARAMFLAG_FIN, (DWORD*)&args[0], &argc, pChannel, &is_iid); as args[] is a local array declared on the stack which is then passed to the function to be invoked - otherwise how does TL_Unmarshal set the arguments? Well I tried changing it, and it made no obvious difference to my bug, but I thought I'd ask anyway. thanks -mike