Dear Samba-Team,

for more than a year we are experiencing file truncation issues on user profile synchronization between two instances of Windows 2016 Server leading to broken app settings for our users.

On initial investigation we have found this bug report: https://bugzilla.samba.org/show_bug.cgi?id=14928
Its description reads suspiciously close to what we are experiencing. While the bug was marked as fixed long ago we were using a samba version 4.13.x which was known to be still affected. In February we upgraded to Ubuntu 22 LTS which included version 4.15.13, and should include this bug fix. 
However, our problems persist.

This is a snippet from the samba log showing the transfer of a file which gets corrupted during transfer:

smbd_smb2_read: fnum 4087310202, file user.V6/AppData/Roaming/LibreOffice/4/user/basic/Standard/Module1.xba, length=1124 offset=0 read=1124
[2023/02/02 14:37:06.489451,  3] ../../source3/smbd/smb2_read.c:425(smb2_read_complete)
  smbd_smb2_read: fnum 3420976685, file user.V6/AppData/Roaming/Slack/Local Storage/leveldb/000005.ldb, length=12045 offset=0 read=12045
[2023/02/02 14:37:06.489575,  3] ../../source3/smbd/smb2_read.c:425(smb2_read_complete)
  smbd_smb2_read: fnum 1325687613, file user.V6/AppData/Roaming/LibreOffice/4/user/basic/Standard/script.xlb, length=349 offset=0 read=349
[2023/02/02 14:37:06.489861,  3] ../../source3/smbd/smb2_read.c:425(smb2_read_complete)
  smbd_smb2_read: fnum 3611910752, file user.V6/AppData/Roaming/LibreOffice/4/user/basic/Standard/dialog.xlb, length=288 offset=0 read=288
[2023/02/02 14:37:06.489887,  3] ../../source3/smbd/nttrans.c:2224(smbd_do_query_security_desc)
  smbd_do_query_security_desc: sd_size = 20.
[2023/02/02 14:37:06.490229,  3] ../../source3/smbd/nttrans.c:2224(smbd_do_query_security_desc)
  smbd_do_query_security_desc: sd_size = 20.
[2023/02/02 14:37:06.490693,  3] ../../source3/smbd/nttrans.c:2224(smbd_do_query_security_desc)
  smbd_do_query_security_desc: sd_size = 20.
[2023/02/02 14:37:06.490784,  3] ../../source3/smbd/smb2_read.c:425(smb2_read_complete)
  smbd_smb2_read: fnum 2701400150, file user.V6/AppData/Roaming/LibreOffice/4/user/basic/script.xlc, length=406 offset=0 read=406
[2023/02/02 14:37:06.490807,  3] ../../source3/smbd/nttrans.c:2224(smbd_do_query_security_desc)
  smbd_do_query_security_desc: sd_size = 20.
[2023/02/02 14:37:06.490860,  3] ../../source3/smbd/nttrans.c:2224(smbd_do_query_security_desc)
  smbd_do_query_security_desc: sd_size = 20.
[2023/02/02 14:37:06.491079,  2] ../../source3/smbd/open.c:1619(open_file)
  ZKRD-DOMAIN\user opened file user.V6/AppData/Roaming/Slack/Local Storage/leveldb/LOG.old read=Yes write=No (numopen=8)
[2023/02/02 14:37:06.491263,  3] ../../source3/smbd/smb2_read.c:425(smb2_read_complete)
  smbd_smb2_read: fnum 4087310202, file user.V6/AppData/Roaming/LibreOffice/4/user/basic/Standard/Module1.xba, length=349 offset=0 read=349
[2023/02/02 14:37:06.491643,  2] ../../source3/smbd/close.c:833(close_normal_file)
  ZKRD-DOMAIN\user closed file user.V6/AppData/Roaming/LibreOffice/4/user/basic/script.xlc (numopen=6) NT_STATUS_OK
[2023/02/02 14:37:06.491855,  3] ../../source3/smbd/smb2_read.c:425(smb2_read_complete)
  smbd_smb2_read: fnum 3420976685, file user.V6/AppData/Roaming/Slack/Local Storage/leveldb/000005.ldb, length=12045 offset=0 read=12045
[2023/02/02 14:37:06.491942,  3] ../../source3/smbd/smb2_read.c:425(smb2_read_complete)
  smbd_smb2_read: fnum 3611910752, file user.V6/AppData/Roaming/LibreOffice/4/user/basic/Standard/dialog.xlb, length=288 offset=0 read=288
[2023/02/02 14:37:06.492042,  3] ../../source3/smbd/smb2_read.c:425(smb2_read_complete)
  smbd_smb2_read: fnum 1325687613, file user.V6/AppData/Roaming/LibreOffice/4/user/basic/Standard/script.xlb, length=349 offset=0 read=349
[2023/02/02 14:37:06.492142,  2] ../../source3/smbd/close.c:833(close_normal_file)
  ZKRD-DOMAIN\user closed file user.V6/AppData/Roaming/LibreOffice/4/user/basic/Standard/Module1.xba (numopen=5) NT_STATUS_OK
[2023/02/02 14:37:06.492193,  3] ../../source3/smbd/smb2_server.c:3954(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_ACCESS_DENIED] || at ../../source3/smbd/smb2_getinfo.c:159
[2023/02/02 14:37:06.492465,  2] ../../source3/smbd/close.c:833(close_normal_file)
  ZKRD-DOMAIN\user closed file user.V6/AppData/Roaming/Slack/Local Storage/leveldb/000005.ldb (numopen=4) NT_STATUS_OK
[2023/02/02 14:37:06.492564,  2] ../../source3/smbd/close.c:833(close_normal_file)
  ZKRD-DOMAIN\user closed file user.V6/AppData/Roaming/LibreOffice/4/user/basic/Standard/dialog.xlb (numopen=3) NT_STATUS_OK
[2023/02/02 14:37:06.492636,  2] ../../source3/smbd/close.c:833(close_normal_file)
  ZKRD-DOMAIN\user closed file user.V6/AppData/Roaming/LibreOffice/4/user/basic/Standard/script.xlb (numopen=2) NT_STATUS_OK
[2023/02/02 14:37:06.492841,  3] ../../source3/smbd/nttrans.c:2224(smbd_do_query_security_desc)
  smbd_do_query_security_desc: sd_size = 20.

This log has been produced using samba 4.15.13+dfsg-0ubuntu1, a few days ago we received 4.15.13+dfsg-0ubuntu1.1 through our unattended security upgrades.

We observe that the file Module1.xba is being processed with the correct length (1124), but for some reasons being reprocessed using a wrong length (349) which happens to be the length of the file script.xlb.

A single occurrence of this issue is not reproducible. To us it looks like a hashing function occasionally assigns a bad length, and as if an instance of the aforementioned bug might still not be fixed.

Thank you for your effort! We would be glad if you deem other possible causes and point them out to us.
While we are running a production setup we are willing to do what possible on our side if you need further information or testing.

Best regards
Stefan