[...]
If I understand you correctly, QueryInterface for IID_IServiceProvider succeeds but method returns NULL instead of valid interface pointer?
Exactly.
This call pEngine->QueryInterface(IID_IServiceProvider, reinterpret_cast<void**>(&servprov))
always returns NULL instead of the expected pointer.