If you send an SMBv2 packet off to Vista SP1 or SP2 that specifies the NEGOTIATE command, and the ProcessIDHigh word is not set to 0x0000, you do not in fact get a DoS. Here’s the dirty dirty dirt dirt dirt. (All addresses SP2) The problem here is that we don’t know how many times things have been called before we got to the target. One way to handle this is to build our opcode that puts a number of GET_PRQUE requests into eipcode. Thankfully, though this can be effectively done in a couple of couple of requests.”]
Source: https://blog.talosintelligence.com/2009/09/smbv2-quotes-dos-quotes.html