Comment 7 for bug 2049634

I just realised that the offset to the first hole matches the default wsize=16580 argument for SMB 1.0 mounts, or at least that is what "mount -l" reports.

That is, cifs is writing each time wsize bytes with the right data + a hole of 3900 bytes made of binary zeros. And the next blocks look the same: wsize bytes with the right data + a hole of 3900 bytes each time.

As noted above, the distance between the "wsize + hole" areas is 20480, which is wsize=16580 + the hole size of 3900 bytes.

For the record, the connection is using RawNTLMSSP, documented as "NTLMSSP without SPNEGO, NTLMv2 hash".