If FSCTL_SRV_ENUMERATE_SNAPSHOTS is called with an invalid fd, a NULL pointer will be dereferenced. 5290faca7a5ae5f3f0309 contains a fix for this remote crash bug.
Looks good
Pushed to v3-6-test. Closing out bug report. Thanks!