Hi,
I have experienced a different behaviour of BthNsLookupServiceNext in CE
5.0 and 6.0.

In CE 5.0 the following is OK:

BthNsLookupServiceNext (*phLookup, BTHNS_LUP_RESET_ITERATOR, &dwUnused,
NULL);
//NULL should be OK since no data is returned for BTHNS_LUP_RESET_ITERATOR

In CE 6.0 it fails, since BTD trys to marshall the last argument (a pointer)
indipendently by dwFlags.
The simple workaround is to pass a dummy LPWSAQUERYSE as the last argument.

What is REALLY annoying is that the offending call with the NULL pointer lies
peacefully in at least four samples in WINCE600 tree...