It appears that the 'source3' SAMR server is available while the AD DC is configured. This could allow access to (say) change a password under less strict access control than the AD DC is enforcing. Thankfully some access control appears to be in place, the same as found in a 'NT4-like' domain. Found by Andrew Bartlett and Samuel Cabrero during discussions about the new RPC server stack. We need to work out if we have exposed anything catastrophic before we remove the embargo here.
A further investigation appears to show that the s3 rpc servers are not registered in this case, so they can't be accessed under any pipe name. I expect to un-embargo and close this soon.
When running as AD DC, the lp_enforce_ad_dc_settings() function sets the default service mode as external except for svcctl, srvsvc, eventlog, ntsvcs, winreg and spoolss which remain embedded. Then the rpc_setup_*() functions won't register the external s3 services, only the embedded ones.
Closing as invalid. Thanks!