From samba-technical:

Found the problem. For SMB1 we need to call cli_shadow_copy_data()
*TWICE* in order for a Windows server to return results. Once with
bool get_names = false, in order to send the max_data_return as
16, which somehow primes the server to expect the second call,
with max_data_return of CLI_BUFFER_SIZE, which then correctly
fetches the data.

This is a Windows SMB1 bug - I'm guessing they never tested the
SMB1 server with a client that just tried a large enough value
to start with to prevent a round trip and their client always
does the '16' followed by whatever that returned.

The Windows SMB2 server works correctly though with one call with a
large enough value.

We still have the problem that when we create the paths previous
versions path to query the SMB1 server returns NT_STATUS_OBJECT_PATH_NOT_FOUND,
due to the fact we're not setting the flags2 FLAGS2_REPARSE_PATH
bit in the request when we're doing the path query. We don't
currently have capabilities to do that, so I'm going to create
another bug and add create fixes for all these things.