A client can add a guid to the dcerpc ncacn header, which means the payload will start 16 bytes later. In order to parse such a packet we need to pass special flags to the ndr parser. This also applies to 3.6 and maybe 3.5
Created attachment 8823 [details] patch for 3.6 and 4.0, same as what is in master
Comment on attachment 8823 [details] patch for 3.6 and 4.0, same as what is in master Looks good to me
Pushed to v3-6-test and autobuild-v4-0-test.
Pushed to v4-0-test. Closing out bug report. Thanks!