"rpcclient -c setdriver blah blah" was broken for 64-bit hosts between 3.4.7 and 3.5.2. It would fail with a DCERPC_FAULT_OP_RNG_ERROR. (Bug #7277 may be the same issue.)
Running with "-d 255" showed the "attributes" element of the spoolss_SetPrinterInfo2 struct was being pushed down into the "priority" element, causing the range error.
cmd_spoolss_setdriver() in source3/rpcclient/cmd_spoolss.c copies and recasts a pointer to a struct spoolss_PrinterInfo2 to a struct spoolss_SetPrinterInfo2. But in 3.5.2, the devmode and secdesc elements (pointers) of the former were changed to devmode_ptr and secdesc_ptr elements (32-bit ints) in the latter, resulting in the subsequent elements being misaligned on 64-bit hosts.
Not sure if it's the right fix, but changing devmode_ptr and secdesc_ptr back to devmode and secdesc pointers in struct spoolss_PrinterInfo2 worked for me on both 32- and 64-bit hosts.
I'll attach a patch.
Created attachment 5634 [details]
revert devmode_ptr and secdesc_ptr fields in spoolss_SetPrinterInfo2
*** This bug has been marked as a duplicate of bug 7277 ***