Index: rpc_server/srv_spoolss_nt.c
===================================================================
--- rpc_server/srv_spoolss_nt.c	(revision 1483)
+++ rpc_server/srv_spoolss_nt.c	(working copy)
@@ -3725,6 +3725,12 @@
 	info->data=NULL;
 	info->count=0;
 
+	/* a bug in xp sp2 rc2 causes it to send a fnpcn request without 
+	   sending a ffpcn() request first */
+
+	if ( !option )
+		return WERR_BADFID;
+
 	for (i=0; i<option->count; i++) {
 		option_type=&(option->ctr.type[i]);
 		
@@ -3787,6 +3793,12 @@
 	info->data=NULL;
 	info->count=0;
 
+	/* a bug in xp sp2 rc2 causes it to send a fnpcn request without 
+	   sending a ffpcn() request first */
+
+	if ( !option )
+		return WERR_BADFID;
+
 	get_printer_snum(p, hnd, &snum);
 
 	for (i=0; i<option->count; i++) {