IRowset::GetNextRows documentation: says this

If *prghRows is not a null pointer on input, it must be a pointer to consumer-allocated memory large enough to return the handles of the requested number of rows. If the consumer-allocated memory is larger than needed, the provider fills in as many row handles as specified by pcRowsObtained; the contents of the remaining memory are undefined.

So you can't pass a random pointer on input. You must set it to something valid or NULL:

HROW* hrow = NULL;