Not even sure ADIR is used, the parameter looks like a file skeleton parameter as is used in ADIR, so it's likely, but unless graand doesn't post the code of the GETFIL2 form init receiving these parameters, showing what's done with them, we know nothing of value to help.
The meaning of a ? in a file skeleton is any character, but it must be a character, unlike * it doesn't stand for as many characters as you like. So in theory ESM??????.ZIP used as ADIR fileskeleton parameter should only list files with names that start with ESM, have 6 more characters, and then the file extension ZIP.
So I made up a showcase with 3 files:
ESM25011.ZIP - a too short name
ESM250101.ZIP - a name fitting the pattern
ESM250101a.ZIP - a name too long
I expected ADIR(laZips,"ESM??????.ZIP") to only create an array item for ESM250101.ZIP and not show the too short and the too long name, but it listed all three files. That's a bug, surely. But a bug that'll always show too many files, never too few files.
Turns out the number of question marks doesn't matter very much, I also get all 3 files from ADIR(laZips,"ESM?????.ZIP") or even ADir(laZips,"ESM????????.ZIP"). ADIR goes back to zero only with 4 or less question marks in the file skeleton parameter. Not sure whether VFP does the pattern matching or delegates that to Windows API and that changed. It may be 8.3 DOS file names used for filtering allow ADIR to start seeing results with 5 question marks, as these names are 9 characters long and have a short file name in the form of ESM???~?.ZIP, to which ESM?????.ZIP already is strictly fitting. Too many question marks should not work, but then maybe VFP/OS doesn't care for extra questionmarks when it gets to the file extension earlier.
Anyway, this bug or by design behavior won't effect you the way you say you're affected as it shows too many, not too few files.
Either you simply where in the wrong directory or you don't have any ESM25????.ZIP files or the code doesn't use ADIR at all and fails on something completely different. That call of the form doesn't tell what goes wrong, though. Only the code of the form itself would show what's going on.