IClrMetaHost::EnumerateLoadedRuntimes randomly returning 0x80070018 (E_BAD_LENGTH?)

We are getting sparse reports by some of our users that build of their projects that uses our tool fails randomly (~1 in 1000 cases). From logs and our error reporting we've determined that this is caused by IClrMetaHost::EnumerateLoadedRuntimes return 0x80070018 result. This is not documented error code for that method and since it's quite generic, we are stuck in diagnosing the cause. We do not have access to the affected machine, but so far we have not found anything suspicious when asking the affected user about their environment.

We are hosting a single CLR instance. Our code obtains IClrMetaHost instance through CLRCreateInstance which returns S_OK. The call to EnumerateLoadedRuntimes follows immediately after and returns the mentioned result. All this happens on a static constructor in managed code:

// Get the meta host.
Guid clrMetaHostIid = new Guid( 0xD332DB9E, 0xB9B3, 0x4125, 0x82, 0x07, 0xA1, 0x48, 0x84, 0xF5, 0x32, 0x16 );
Guid clrMetaHostClsid = new Guid( 0x9280188d, 0xe8e, 0x4867, 0xb3, 0xc, 0x7f, 0xa8, 0x38, 0x84, 0xe8, 0xde );
IntPtr pClrMetaHost;
int hr = CLRCreateInstance( ref clrMetaHostClsid, ref clrMetaHostIid, out pClrMetaHost );
if ( hr != 0 )
    throw new COMException(string.Format( "CLRCreateInstance returned {0:x}.", hr ), hr);

IClrMetaHost clrMetaHost = (IClrMetaHost) Marshal.GetObjectForIUnknown( pClrMetaHost );

// Enumerate the loaded CLR. There should be a single one, so take the first.
IEnumUnknown enumerator;
hr = clrMetaHost.EnumerateLoadedRuntimes( GetCurrentProcess(), out enumerator );
if ( hr != 0 )
    throw new COMException(string.Format("EnumerateLoadedRuntimes returned {0:x}.", hr), hr);
IntPtr pClrRuntime;
int fetched;
hr = enumerator.Next( 1, out pClrRuntime, out fetched );
if ( hr != 0 )
    throw new COMException(string.Format("IEnumUnknown.Next returned {0:x}.", hr), hr);
if ( fetched != 1 )
    throw new AssertionFailedException(string.Format( "Unexpected number of .NET Frameworks detected: {0}", fetched ));
ClrRuntimeInfo = (IClrRuntimeInfo) Marshal.GetObjectForIUnknown( pClrRuntime );
return;

The code above didn't change for 7 years. It may not be relevant, but we were getting 1-2 reports a year and in 2017 started getting about 2 a month.

We solved another issue with this call long time ago.

Any ideas?

Thanks in advance.

Daniel @ PostSharp Technologies