18.104.22.168 Application Requests Reading from a File, Named Pipe, or Device
Processing of this event is handled as specified in [MS-CIFS] section 22.214.171.124, with the following additions:
The SMB_COM_READ_ANDX command request has been extended as specified below.
The Timeout field specified in [MS-CIFS] section 126.96.36.199.1 has been extended to be the Timeout_or_MaxCountHigh field. This field is treated as a union of a 32-bit Timeout field and a 16-bit unsigned integer named MaxCountHigh, as specified in section 188.8.131.52.1.
For pipe reads, the client MUST use Timeout_or_MaxCountHigh as the Timeout field. The client MUST set the Timeout field either to a time-out value in milliseconds, or to 0xFFFFFFFF.<89> The latter value indicates to the server that the operation MUST NOT time out.
For file reads, the client MUST use this as the MaxCountHigh field. If the count of bytes to read is larger than 0xFFFF bytes in length, then the client MUST use the MaxCountHigh field to hold the two most significant bytes of the count, thus allowing for a 32-bit read count when combined with MaxCountOfBytesToReturn field. If the read count is not larger than 0xFFFF, then the client MUST set MaxCountHigh to zero.