fixme:ole:RPCRT4_NdrClientCall2 (pStubDec == ^0x2476aa98,pFormat = ^0x2476a626,...): stub
That isn't going to work until Rob cleans up and submits his patch to implement interpretive marshalling. The refcounting problem is probably just a side-effect of that. Try using native DCOM for now.