Demonstrate a refcount leak on the class factory when a class with ThreadingModel=Apartment is instantiated in the MTA. CoGetClassObject ends up using apartment_hostobject to launch an STA thread in which to host the object, but the process of marshaling this class factory back into the MTA leaks a reference on it.
This leak is usually minor (class factory implementations are usually singletons, so it's a one-of rather than a cumulative leak), but it will generally lock that COM server and e.g. prevent CoFreeUnusedLibraries from being able to clean up properly.
When CoMarshalInterface succeeds, it added an *additional* refcount represented by the marshaling data written to the stream. The original refcount returned from apartment_getclassobject needs to be released regardless of marshaling success or failure.