I had a Windows 2003, Exchange 2007 box running hub transport, client access, and mailbox roles. When upgrading to SP3 (Direct from SP1) The upgrade's to hub transport and client access completed ok, however the Mailbox role upgrade failed with the error "An error occurred. The error code was 3221684229. The message was Access is denied..".
I looked in the Exchangesetup.log and found several Access Denied entry's for "f:8.03.0083sourcesdevadminsrclibsbasebasemisc.cxx:1353"; this made no sense as the f: drive only contained log files.
I re-ran SP3 setup, whilst monitoring it with Sysinternals Process Monitor and found a single Access Denied was logged, this was for a DeviceHarddiskVolume4. I found that the DeviceHarddiskVolume4 volume was mounted in a folder under the OWA IIS folder (In this instance: C:Program FilesMicrosoftExchange ServerClientAccessOwa). I removed this volume and then ran the setup again, this time SP3 installed correctly.
I've posted this in case anyone else has this issue, as it is not apparent from the initial error message or Exchangesetup.log that the cause of this Mailbox role upgrade error lie's within the ClientAccess folder.