The customer app that occasionally fails (and the test app that never failed) currently has the following (circa 2005) P/Invoke signature:

  Private Declare Function GetVolumeSerialNumber Lib "kernel32.dll" Alias "GetVolumeInformationA" (ByVal lpRootPathName As String, _
                     ByVal lpVolumeNameBuffer As String, _
                     ByVal nVolumeNameSize As Integer, _
                     ByRef lpVolumeSerialNumber As Long, _
                     ByVal lpMaximumComponentLength As Integer, _
                     ByVal lpFileSystemFlags As Integer, _
                     ByVal lpFileSystemNameBuffer As String, _
                     ByVal nFileSystemNameSize As Integer) As Long

After taking out my pencil sharpener and trying to come up with the perfect signature, we are changing to the following newer signature to see if that helps:

  <Runtime.InteropServices.DllImport("kernel32.dll", CharSet:=Runtime.InteropServices.CharSet.Unicode, ThrowOnUnmappableChar:=True, SetLastError:=True)> _
  Private Shared Function GetVolumeInformation( _
                                               ByVal lpRootPathName As System.String, _
                                               ByVal lpVolumeNameBuffer As System.Text.StringBuilder, _
                                               ByVal nVolumeNameSize As System.UInt32, _
                                               ByRef lpVolumeSerialNumber As System.UInt32, _
                                               ByRef lpMaximumComponentLength As System.UInt32, _
                                               ByRef lpFileSystemFlags As System.UInt32, _
                                               ByVal lpFileSystemNameBuffer As System.Text.StringBuilder, _
                                               ByVal nFileSystemNameSize As System.UInt32 _
                                               ) As <Runtime.InteropServices.MarshalAs(Runtime.InteropServices.UnmanagedType.Bool)> System.Boolean
  End Function

It isn't good to throw changes out just to see what sticks but the Trend Micro theory doesn't sound provable in this situation.  If you feel like something wouldn't be marshalled right with the first signature it won't hurt my circa 2005 feelings to tell me.  Same for the second signature.