Hello, I think it's a Blackberry 4.5 bug. I have got the same problem.
I have generated a web service client stub with the Wireless Toolkit 2.5.2 and when I invoke a webservice method that replys with a response that contains a null strings it throws that MarshalException. But when I run the same application on 4.7 devices, it works.
I have made some tests and it seems that null strings can be send but cannot be received although the send/receive packages look the same(I have captured them with a sniffer).
I have searched also a way to catch the package to modify it but i've got nothing.
Did anyone managed to solve this problem?