Created attachment 8054 [details]
Proposed patch to fix the problem

it checks for a taskid != 0 and return appropriate error code

The specification is in MS-DRSR.pdf:

4.1.6.3 Server Behavior of the IDL_DRSExecuteKCC Method
If an error occurs, a Windows error code is returned. If successful, the method returns 0.
msgIn: DRS_MSG_KCC_EXECUTE_V1
ValidateDRSInput(hDrs, 18)
IN
ULONG
IDL_DRSExecuteKCC(
[in, ref] DRS_HANDLE hDrs,
[in] DWORD dwInVersion,
[in, ref, switch_is(dwInVersion)]
DRS_MSG_KCC_EXECUTE *pmsgIn)
Informative summary of behavior: The IDL_DRSExecuteKCC method triggers the execution of
tasks that generate and maintain the replication topology between DCs.<14> See [MS-ADTS]
section 6.2.2 for more information related to the tasks performed by the KCC upon receipt of an
IDL_DRSExecuteKCC request.
msgIn := pmsgIn^.V1
/* Validate the request version */
if dwInVersion ≠ 1 then
return ERROR_DS_DRA_INVALID_PARAMETER
endif

it seems that there is a mistake in the copy and paste:

after 
msgIn := pmsgIn^.V1
/* Validate the request version */
if dwInVersion ≠ 1 then
return ERROR_DS_DRA_INVALID_PARAMETER
endif

There should be: 

if msgIn.dwTaskID ≠ 0 then
return ERROR_INVALID_PARAMETER
endif

Comment on attachment 8054 [details]
Proposed patch to fix the problem

Based on our discussion on IRC, looks reasonable

Patch applies as-is to v4-0-test, Karolin, please pick for rc3.

Comment on attachment 8054 [details]
Proposed patch to fix the problem

Looks good

Pushed to autobuild-v4-0-test.
Closing out bug report.

Thanks!