diff --git a/librpc/idl/dfsblobs.idl b/librpc/idl/dfsblobs.idl
index 88147b6..2c06079 100644
--- a/librpc/idl/dfsblobs.idl
+++ b/librpc/idl/dfsblobs.idl
@@ -59,7 +59,7 @@ interface dfsblobs
 	typedef struct {
 		[relative_short] nstring *special_name;
 		uint16 nb_expanded_names;
-		[relative_short,subcontext(0),flag(STR_NOTERM|NDR_REMAINING)] string_array *expanded_names;
+		[relative_short,subcontext(0),flag(STR_NOTERM|NDR_REMAINING)] nstring_array *expanded_names;
 	} dfs_domain_referral;
 
 	typedef [nodiscriminant] union {
@@ -69,7 +69,7 @@ interface dfsblobs
 	} dfs_referral;
 
 	typedef [nodiscriminant] union {
-		[case(16)] uint8 *value;
+		[case(16)] uint8 value[16];
 		[default];
 	} dfs_padding;
 
diff --git a/source4/smb_server/smb/trans2.c b/source4/smb_server/smb/trans2.c
index 38381fd..a288f90 100644
--- a/source4/smb_server/smb/trans2.c
+++ b/source4/smb_server/smb/trans2.c
@@ -873,7 +873,8 @@ static NTSTATUS fill_normal_dfs_referraltype(struct dfs_referral_type *ref,
 		ZERO_STRUCTP(ref);
 		ref->version = version;
 		ref->referral.v3.data.server_type = DFS_SERVER_NON_ROOT;
-		ref->referral.v3.size = 18;
+		/* "normal" referral seems to alway include the GUID */
+		ref->referral.v3.size = 34;
 
 		ref->referral.v3.data.entry_flags = 0;
 		ref->referral.v3.data.ttl = 600; /* As w2k3 */
@@ -885,7 +886,8 @@ static NTSTATUS fill_normal_dfs_referraltype(struct dfs_referral_type *ref,
 		ZERO_STRUCTP(ref);
 		ref->version = version;
 		ref->referral.v4.server_type = DFS_SERVER_NON_ROOT;
-		ref->referral.v4.size = 18;
+		/* "normal" referral seems to alway include the GUID */
+		ref->referral.v4.size = 34;
 
 		if (isfirstoffset) {
 			ref->referral.v4.entry_flags =  DFS_HEADER_FLAG_TARGET_BCK;
@@ -914,7 +916,7 @@ static NTSTATUS fill_domain_dfs_referraltype(struct dfs_referral_type *ref,
 		ZERO_STRUCTP(ref);
 		ref->version = version;
 		ref->referral.v3.data.server_type = DFS_SERVER_NON_ROOT;
-		ref->referral.v3.size = 34;
+		ref->referral.v3.size = 18;
 		ref->referral.v3.data.entry_flags = DFS_FLAG_REFERRAL_DOMAIN_RESP;
 		ref->referral.v3.data.ttl = 600; /* As w2k3 */
 		ref->referral.v3.data.referrals.r2.special_name = domain;
@@ -1249,7 +1251,7 @@ static NTSTATUS dodomain_referral(TALLOC_CTX *ctx,
 
 	referral = talloc(tab, struct dfs_referral_type);
 	NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral, context);
-	referral_str = talloc_asprintf(referral, "\\%s", dns_domain);
+	referral_str = talloc_asprintf(referral, "\\%s", netbios_domain);
 	NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral_str, context);
 	status = fill_domain_dfs_referraltype(referral,  3,
 					      referral_str,
@@ -1265,7 +1267,7 @@ static NTSTATUS dodomain_referral(TALLOC_CTX *ctx,
 
 	referral = talloc(tab, struct dfs_referral_type);
 	NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral, context);
-	referral_str = talloc_asprintf(referral, "\\%s", netbios_domain);
+	referral_str = talloc_asprintf(referral, "\\%s", dns_domain);
 	NT_STATUS_HAVE_NO_MEMORY_AND_FREE(referral_str, context);
 	status = fill_domain_dfs_referraltype(referral,  3,
 					      referral_str,
