Thanks for sharing. I spent many hours trying to figure this out when the HFW3200S came on scene and gave up. Just checked back--first time in several months--and your URL did the trick.
http://IP:9989/onvif/media_service/snapshot?channel=1&subtype=0
Older HDB3200C continue to work with:
http://IP/onvif/media_service/snapshot
Thanks again.