I'm not familiar with your command, but based on what you're showing, I can hazard a guess. From the double parentheses it looks like ATTLIST is expecting a list of values, as in ATTLIST((x) (y)). Furthermore, from an example I found via Google, each list item has multiple elements, as in ATTLIST((* *PDF *N QPSUPRTF)).

When the keyword is expecting any kind of list, you must pass a list. If you have CHGVAR &ATTLIST '* *PDF *N QPSUPRTF', it won't work. ATTLIST((&ATTLIST)) is equivalent to ATTLIST(('* *PDF *N QPSUPRTF')), which is a list that contains a single nested item that consists of a single character string, which is not the same as a nested item that consists of 4 elements.

What you'll probably need to do is build the entire command string in a single large *CHAR field, then pass that to QCMDEXC (or equivalent). Most of it, command name, keywords, parentheses, and so on, are fixed, so you can concatenate literals with your existing variables:

CHGVAR &CMD VALUE('ESndMail Recipient(' *CAT &Addr *TCAT ')' +
       *CAT ' SUBJECT(''Email Report'')' +
       *CAT ' MSG(''Attached is your report'')' +
       *CAT ' ATTLIST((' *CAT &ATTLIST *CAT '))')
CALL QCMDEXC(&CMD 1024) /* or whatever the length of &CMD is */

I'm doing this off the cuff, so that concatenate may not be 100% valid as is, but you get the idea.

oh, I remember that one, we had it at Borders - I wrote a procedure for entry to the command program.  But the corporation no longer exists, and I have no idea what happened to the source I wrote there.