I just realised that the offset to the first hole matches the default wsize=16580 argument for SMB 1.0 mounts, or at least that is what "mount -l" reports.
That is, cifs is writing each time wsize bytes with the right data + a hole of 3900 bytes made of binary zeros. And the next blocks look the same: wsize bytes with the right data + a hole of 3900 bytes each time.
As noted above, the distance between the "wsize + hole" areas is 20480, which is wsize=16580 + the hole size of 3900 bytes.
For the record, the connection is using RawNTLMSSP, documented as "NTLMSSP without SPNEGO, NTLMv2 hash".
I just realised that the offset to the first hole matches the default wsize=16580 argument for SMB 1.0 mounts, or at least that is what "mount -l" reports.
That is, cifs is writing each time wsize bytes with the right data + a hole of 3900 bytes made of binary zeros. And the next blocks look the same: wsize bytes with the right data + a hole of 3900 bytes each time.
As noted above, the distance between the "wsize + hole" areas is 20480, which is wsize=16580 + the hole size of 3900 bytes.
For the record, the connection is using RawNTLMSSP, documented as "NTLMSSP without SPNEGO, NTLMv2 hash".