Win8's Spell Checking API sends null as out param

I am implementing a Windows 8 Spell Checking COM service in C++ without ATL, but when Windows' msspellcheckinghost.exe calls my ISpellCheckProviderFactory::SupportedLanguages() it passes nullptr as the out param, to which I naturally return E_POINTER ... which results in a fail and an event log message of:

Failed instantiating third-party spellchecking provider: CLSID {...}, HRESULT 0x80004003.

When I make the factory class and DLL loader use ATL, then the host calls the function correctly. Which makes no sense, as the subsequent non-ATL EnumString implementation is used correctly. So why can ATL be required for the factory, but not after?

What makes matters worse, is that I have no idea how to attach the debugger to the host, as msspellcheckinghost.exe is undocumented so no clue what to pass to it.

The project source is available at https://github.com/TinoDidriksen/spellers/tree/master/win8 - prototypes are basically copied from Microsoft's own sample project, but I ripped the ATL parts out because I want the GUIDs to be loaded from a config file at runtime (that part works).

The same thing happens on 32bit OS+DLL, so has nothing to do with that.

With the help of MS forums, the problem turned out to be that ISpellCheckProviderFactory is not an IClassFactory, and the DLL must return a proper IClassFactory that in turn can CreateInstance() the actual provider factory.