Out of memory exception while registering to a WMI event query

Short: What could cause an out-of-memory error when registering a WQL event query (error code 0x80041006)? How can we investigate the cause?

Long: We keep getting an out-of-memory exception when trying to register a specific WQL event query in the MicrosoftDNS provider in a windows 2003 R2 server.

We can reproduce by registering the following WQL notification query in wbemtest:

select * from __InstanceOperationEvent within 20 where TargetInstance.ContainerName="xyz.com" AND (TargetInstance ISA "MicrosoftDNS_CNAMEType")

Here is the wbemess.log file that corresponds to this query and exception:

(Tue Nov 10 10:19:14 2009.66327484) : Polling query 'select * from MicrosoftDNS_CNAMEType where ContainerName = "xyz.com"' failed with error code 0x80041006. Will retry at next polling interval
(Tue Nov 10 10:19:14 2009.66327484) : Polling query 'select * from MicrosoftDNS_CNAMEType where ContainerName = "xyz.com"' failed on the first try with error code 0x80041006.
Deactivating subscription

Other types (e.g. MicrosoftDNS_AType) seem to work fine.

What could be the cause of such an error? How can we debug / track it down? Are there any throttles / quotas we can try adjusting to find the problem? Any help of pointers would be highly appreciated.
Please little 'r' me since I'm not on this DL.

P.S. The full log section corresponding to this repro:

(Tue Nov 10 10:19:13 2009.66326250) : Registering notification sink with query select * from __InstanceOperationEvent within 20 where TargetInstance.ContainerName="xyz.com" AND (TargetInstance ISA "MicrosoftDNS_CNAMEType") in namespace //./root/MicrosoftDNS.
(Tue Nov 10 10:19:13 2009.66326250) : Activating filter 0A2F8D88 with query select * from __InstanceOperationEvent within 20 where TargetInstance.ContainerName="xyz.com" AND (TargetInstance ISA "MicrosoftDNS_CNAMEType") in namespace //./root/MicrosoftDNS.
(Tue Nov 10 10:19:13 2009.66326250) : Activating filter 0A35B658 with query select * from __ClassOperationEvent where TargetClass isa "MicrosoftDNS_CNAMEType" in namespace //./root/MicrosoftDNS.
(Tue Nov 10 10:19:13 2009.66326250) : Activating filter 'select * from __ClassOperationEvent where TargetClass isa "MicrosoftDNS_CNAMEType"' with provider $Core
(Tue Nov 10 10:19:13 2009.66326265) : Activating filter 'select * from __InstanceOperationEvent within 20 where TargetInstance.ContainerName="xyz.com" AND (TargetInstance ISA "MicrosoftDNS_CNAMEType")' with provider $Core
(Tue Nov 10 10:19:13 2009.66326265) : Instituting polling query select * from MicrosoftDNS_CNAMEType where ContainerName = "xyz.com" to satisfy event query select * from __InstanceOperationEvent within 20 where TargetInstance.ContainerName="xyz.com" AND (TargetInstance ISA "MicrosoftDNS_CNAMEType")
(Tue Nov 10 10:19:13 2009.66326265) : Executing polling query 'select * from MicrosoftDNS_CNAMEType where ContainerName = "xyz.com"' in namespace '//./root/MicrosoftDNS'
(Tue Nov 10 10:19:14 2009.66327484) : Polling query 'select * from MicrosoftDNS_CNAMEType where ContainerName = "xyz.com"' failed with error code 0x80041006. Will retry at next polling interval
(Tue Nov 10 10:19:14 2009.66327484) : Polling query 'select * from MicrosoftDNS_CNAMEType where ContainerName = "xyz.com"' failed on the first try with error code 0x80041006.
Deactivating subscription
(Tue Nov 10 10:19:14 2009.66327484) : Deactivating filter 0A35B658
(Tue Nov 10 10:19:14 2009.66327484) : Deactivating filter 0A2F8D88

Try something like that:

1) Run "wbemtest" on cmd prompt 2) Connect to the "root" namespace (not "root\default", just "root") 3) Select Open Instance, and specify "__ProviderHostQuotaConfiguration=@" 4) Check "Local Only" for easier readability and you will see the threshold values 5) Change the MemoryPerHost value to something greater - eg. Double it (256 MB) 6) Save Property 7) Save Object 8) Exit restart WMI services