Samba notify.c notify_marshall_changes() calls ndr_push_struct_blob() to package file information into change notify buffer. ndr_push_struct_blob allocates the temporary data blob with extra buffer. The temporary data blob length is used to compare against client output buffer length, and causes the file information to be dropped. Usually it's not an issue, since client normally accepts large enough output buffer. 

In case of Windows Explorer, it gives only 32 bytes and cause the file entry to be dropped and returning NOTIFY_ENUM_DIR error. But client is able to get the changes as it is re-enumerating(using find) data even when it receives NOTIFY_ENUM_DIR error. But I think we should discard the extra padding while comparing against max offset.

		ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &m,
			(ndr_push_flags_fn_t)ndr_push_FILE_NOTIFY_INFORMATION);
		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
			return false;
		}

		if (DEBUGLEVEL >= 10) {
			NDR_PRINT_DEBUG(FILE_NOTIFY_INFORMATION, &m);
		}

		if (!data_blob_append(talloc_tos(), final_blob,
				      blob.data, blob.length)) {
			data_blob_free(&blob);
			return false;
		}

		data_blob_free(&blob);

		if (final_blob->length > max_offset) {  <--- final_blob contains extra padding
			/* Too much data for client. */
			DEBUG(0, ("Client only wanted %d bytes, trying to "
				   "marshall %d bytes\n", (int)max_offset,
				   (int)final_blob->length));
			return False;
		}


Ideally we should compare the unaligned notify information size with max offset instead of aligned data which has the extra padding.