[...]
If I understand you correctly, QueryInterface for IID_IServiceProvider succeeds but method returns NULL instead of valid interface pointer?
Exactly.
This call pEngine->QueryInterface(IID_IServiceProvider, reinterpret_cast<void**>(&servprov))
always returns NULL instead of the expected pointer.
What is HRESULT? Is it S_OK or E_NOINTERFACE?
Are you calling GetEngine() and QueryInterface on the same thread as you created Cortona ActiveX control?