Created attachment 17873 [details]
Response with credit 0 for request containing a malformed MessageID

When I used a TreeConnection request with a mutated MessageID field, the smbd server grants zero credit to the client.

The normal TREECONNECT request contains a MessageID with value 3. If this field is mutated from 3 to 252, the server would respond with a TREECONNECT response whose credit is 0, as shown in the attached file. However, the guideline [1] says that "The server MUST ensure that the number of credits held by the client is never reduced to zero."


[1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/2e366edb-b006-47e7-aa94-ef6f71043ced