Some time looking at the traces, I have seen un-known (probably
invalid) create_action value ( > 100 not always same). Also, the
CreateAndx response is bigger (always 135B length in the NBT header
instead of usual 103B) and has some string in it after byte_count
field. This I have seen even when the create action is correct. Has any
one else seen this? Does it mean anything?

The server is windows 200o with SP4.

Any info would be of great help.