If cli_smb2_list() were one of the first operations performed on the SMBv2 connection, it would fail due to insufficient credits. Because the response buffer size is (potentially) so much larger (the max SMB transaction size), it requires more credits (128) compared with other SMB operations.
    
When talking to a samba DC, the connection credits seem to start off at 1, then increase by 32 for every SMB reply we receive back from the server. After cli_full_connection(), the connection has 65 credits. The cli_smb2_create_fnum() in cli_smb2_list() adds another 32 credits, but this is still less than the 128 that smb2cli_query_directory() requires.
    
This problem doesn't *normally* seem to happen for smbclient because the cli_cm_open() API it uses ends up sending more messages, and so the connection has more credits.

However, it may be worth backporting changes to improve this problem, just in case it could be seen with smbclient in certain configurations. And having a better error message if a client operation fails due to insufficient SMBv2 credits would definitely help diagnosing this problem, if it ever crops up in different circumstances.