I ran

rpcclient -c "netshareenum" -U "" -W "" -N -d 100 dumdum

and monitored it with ethereal. I found that it did successfully open
\pipe\srvsvc  but as you can see in the log at http://nntsoft.com/rpcclient.txt,
rpcclient barks with

bind_rpc_pipe: pipe_name \PIPE\lsass != expected pipe \PIPE\srvsvc.  oh well!
rpc_pipe_bind: check_bind_response failed.
cli_nt_session_open: rpc bind to \PIPE\srvsvc failed

I also noticed (in ethereal) that there were two requests to close fnum 4001.
The first one, of course, was success. The second got back with a
STATUS_INVALID_HANDLE.

The system is gentoo 1.4, kernel 2.4.23, samba 3.0. This is reproducible on
another Fedora Core 1 with samba 3.0 too.