SMB_QUERY_FILE_ALL_INFO not correct in SNIA spec?

[Joey Collins]

Good evening ladies and gents,

The SNIA definition of the data required for SMB_QUERY_FILE_ALL_INFO
does not appear to be correct. Furthermore, Ethereal's interpretation
does not seem right, either. 

Here's what SNIA says:

    TIME  CreationTime;
    TIME  LastAccessTime;
    TIME  LastWriteTime;
    TIME  ChangeTime;
    ULONG Attributes; // SNIA says USHORT; Ethereal says ULONG
    LARGE_INTEGER AllocationSize;
    LARGE_INTEGER EndOfFile;
    ULONG NumberOfLinks;
    UCHAR DeletePending;
    UCHAR Directory;
    LARGE_INTEGER IndexNumber;
    ULONG EaSize;
    ULONG AccessFlags;
    LARGE_INTEGER IndexNumber1; // mistake in SNIA spec?
    LARGE_INTEGER CurrentByteOffset;
    ULONG Mode;
    ULONG AlignmentRequirement;
    ULONG FileNameLength;
    STRING FileName[];

After poking around with a sniffer, here is what I think it looks 
like:

    TIME    CreationTime;
    TIME    LastAccessTime;
    TIME    LastWriteTime;
    TIME    ChangeTime;
    ULONG   Attributes; 
    ULONG   Pad1;  // assumed
    LARGE_INTEGER AllocationSize;
    LARGE_INTEGER EndOfFile;
    ULONG   NumberOfLinks;
    UCHAR   DeletePending;
    UCHAR   Directory;
    USHORT  Pad2; // assumed
    ULONG   EaSize;
    ULONG   FileNameLength;
    STRING  FileName[];

This is simply the concatenation of Basic Info, Standard Info (plus 
padding, Pad2, which is not in the SNIA spec), EA Info, and 
File Name Info. There is no sign of the rest of the information
(internal file system index numbers, open-file information) being
present.

In my test I used a Win 2000 client, a Win 2000 server, and used
SMB_COM_QUERY_FILE_INFORMATION (by fid, not by path).

My questions:

1) Can anyone else confirm my interpretation?

2) Are there server-dependent variations on the format?
 

thanks all for your time and best regards,

Joey.