----------------------------------------------------------------------
Windows NT and Windows NT Advanced Server 3.1 Update (CSD Version 002)
----------------------------------------------------------------------



Contents
--------
1.0  Introduction
2.0  Installation Instructions for the Windows NT Update Utility
2.1  User Notes
2.2  Bugs Fixed in the Windows NT Update




1.0  Introduction
-----------------
This release of the Windows NT 3.1 Update contains all the components that 
have been fixed since the original release of Windows NT 3.1 and 
Windows NT Advanced Server 3.1. The Update is easy to apply from within 
Windows NT and changes only those files that were originally set up on the 
Windows NT or Windows NT Advanced Server system.  Subsequent Update releases 
will be cumulative: they will contain all previous fixes, as well as any new 
fixes made to the system.



2.0  Installation Instructions for the Windows NT Update Utility
----------------------------------------------------------------
Running Update from a floppy disk:
1.  Insert Update Disk 1 into the floppy drive.
2.  At the Windows NT Command Prompt, change to that floppy drive (that is, 
    A: or B:) and type UPDATE.
3.  Follow the instructions given on the screen.

Running Update from a CD-ROM:
1.  Insert the Update CD-ROM disk into the CD-ROM drive.
2.  At the Windows NT Command Prompt, change to that CD-ROM drive, then 
    change to the i386 or MIPS directory (depending upon whether you have 
    an Intel or MIPS CPU), and type UPDATE.
3.  Follow the instructions given on the screen.

Running Update from a network drive:
1.  At the Windows NT Command Prompt, type the command to connect to the 
    network drive on which the Update files reside.
2.  Change to that network drive and type UPDATE.
3.  Follow the instructions given on the screen.



2.1  User Notes
---------------
Emergency Repair Diskette

If it is necessary to use the Windows NT Emergency Repair Diskette to
repair your Windows NT system at some time after you apply the Update, 
you will need to re-apply the Update after the repair is completed.
This is because the Emergency Repair Diskette repairs your system by
restoring your original Windows NT setup.  After the repair has
completed, simply follow the above Installation Instructions to re-apply
the Update.


Adding New Components to the System

If new software or hardware components are changed or added to your 
system after you have applied the Update, it will be necessary to 
re-apply the Update.  This is necessary since the files taken from 
the original Windows NT disk set may not be equivalent to the files 
on the Update disk set.


Configuring the NWLink Transport 

When configuring the NWLink transport using the Network option in Control 
Panel, you must enter the Network Number as a hexadecimal value rather 
than as a decimal value as stated in the Help file. 


Command Reference Colors

Some commands in the Command Reference (NTCMDS.HLP) list of commands are 
not visible if a user's system colors are set to Window Text = white and 
Window Background = black. Change your Windows Background to a lighter 
color to see all commands in the list.



2.2  Bugs Fixed in the Windows NT Update
----------------------------------------
Bug # 766  Multiple NE3200 cards in MIPS cause system failure.
Description of bug:
When you install multiple NE3200s in a MIPS DUO machine,
the machine will hang while loading services and will become completely
unusable. You cannot run anything that has a reliance on a service (i.e.,
eventvwr, rdr, srv, control panel->devices, control panel->services, etc.).
Component(s) affected:
elnk16.sys
elnkmc.sys
lance.sys
ndis.sys
ne3200.sys
hal*.dll


Bug # 786  Services For Macintosh:  Mac Passwords with lower-case extended 
characters don't work correctly.
Description of bug:
If a Mac client changes its password on a Windows NT Advanced Server and 
uses a lower-case extended character, logons to the domain from a Windows NT 
client with that password will subsequently fail.  Using an upper-case 
extended character, the user will be able to log on to the domain correctly.
Component(s) affected:
sfmsrv.sys


Bug # 793  Proteon driver loses pending requests.
Description of bug:
The problem was that the driver did not wait for the last step of card
initialization (enabling the transmitter) to complete before telling the
system that it was done.  On a very fast machine, a transport (e.g., NBF)
could be loaded before the transmitter finished enabling (this can take over
a second).  This would cause the card not to properly enable, so it would 
not transmit.
Component(s) affected:
proteon.sys


Bug # 826  Format fails with "error writing partition table."
Description of bug:
SETUP will fail when formatting a partition on some machines.
FORMAT will fail with the message "error writing partition table."
FORMAT will write the new system ID on the wrong partition.
Component(s) affected:
hal*.dll


Bug # 862  NTLDR Error message "IoAllocateAdapterChannel: Adapter in use"
Description of bug:
NTLDR prints

    "IoAllocateAdapterChannel: called while Adapter in use"

40-50 times while reading the disk during the loading of the system.  This 
only occurs on two large disk systems (24 drives on 4 channel SCSI 
controller).  It appears smaller systems (13 and 3 drives) do not show this 
problem.  System appears to boot OK, just the annoying message.
Component(s) affected:
ntldr


Bug # 870  PortUAS should have Ctrl+C handler to restore user modals.
Description of bug:
The PortUAS app sets the user modals (such as minimum password length, and
password history) to temporary values while the application is running, and 
then sets them to their final values at the end of the run.  If the admin 
hits ^C (Control+C), the temporary values are left in effect.
Component(s) affected:
portuas.exe


Bug # 877  Services For Macintosh:  Print monitor does not handle >255 zones.
Description of bug:
There is a hard-wired constant in the monitor that should be changed to 
dynamic if a return code indicates buffer overflow.
Component(s) affected:
sfmatalk.sys
sfmmon.dll
sfmprint.exe
sfmsrv.sys


Bug # 878  Services For Macintosh:  Router double faults.
Description of bug:
Router double faults if attempting to get the zone list for a large number 
of zones.  The problem has to do with a very deep nesting of calls when the 
router routes internally.
Component(s) affected:
sfmatalk.sys
sfmmon.dll
sfmprint.exe
sfmsrv.sys


Bug # 895  Services For Macintosh:  Print spooler does not work for embedded 
jobs.
Description of bug:
The problem was that all data after the EOF in the job stream was being 
discarded.
Component(s) affected:
sfmprint.exe


Bug # 984  Memory corruption occurs under extremely heavy stress.
Description of bug:
When a very heavy server stress was run (14 disks, 256Mb memory, 400 
processes), after 6 to 20 hours the machine crashes because a page of memory 
is being reused when it should not be.
Component(s) affected:
ntoskrnl.exe
ntkrnlmp.exe


Bug # 996  RASCAUTH: Problem uppercasing extended characters
Description of bug:
RASCAUTH.DLL (RAS client side authentication) doesn't properly uppercase
extended characters in usernames/passwords.
Component(s) affected:
rascauth.dll


Bug # 1087  Changing nonpagedpool in registry makes system unbootable.
Description of bug:
If this value is changed to be larger than about 1/3 of the system's 
physical memory, the system will not boot.
Component(s) affected:
ntoskrnl.exe
ntkrnlmp.exe


Bug # 1123  UPS service does not shut down Windows NT after expected battery 
life.
Description of bug:
When using a UPS that does not have the ability to send a low battery signal
to the computer, the user must specify the expected battery life and the
charge rate for the battery.  When the battery life drops to 2 minutes, the
file specified in the "Execute command file" field should be executed and
Windows NT should then shut down. This file is never run and a shutdown of
Windows NT never occurs. What happens instead is that, when the expected
battery life time is reached, the UPS service terminates.
Component(s) affected:
ups.exe


Bug # 1131  TCP corrupts data if reserved bits in header are set.
Description of bug:
There is a potential for data corruption in TCP. There are six bits in the
TCP header that are reserved and are supposed to be zero. If two of these
bits are set in a data-bearing segment, TCP will miscalculate the data 
offset by up to three bytes and possibly corrupt the data. Most stacks, 
however, do not set these bits.
Component(s) affected:
tcpip.sys


Bug # 1135  NBF can disconnect WFW 3.11 RAS clients incorrectly.
Description of bug:
The problem is that NBF does not reset its counter when it
acknowledges an I-frame due to a non-final RR (Receive Ready).
Component(s) affected:
nbf.sys


Bug # 2178  Browse option does not handle compressed files.
Description of bug:
The Browse option will not accept a share with compressed files.
Component(s) affected:
drivers.dll


Bug # 2358  WinMSD File Details access violates on some files.
Description of bug:
Locating "fat_rec.sys" with the File Find feature and then asking for
File Details causes an access violation.
Component(s) affected:
winmsd.exe


Bug # 2506  Archive 2250 gets bad block on tape during restore.
Description of bug:
The Archive 2250 backs up and verifies correctly, but when it attempts to 
restore data, the tape device hangs and writes "Fatal error on drive 1" to 
the screen.  In the Event Viewer, the following error is recorded:  "The 
device \Device\Tape0 has a bad block."
Component(s) affected:
archqic.sys


Bug # 2522  Performance Monitor access violates when playing back log data 
when PerfData is bad.
Description of bug:
If Performance Monitor is monitoring multiple systems, and one of them goes 
down, then the log file may not be readable.  If it is not readable, 
Performance Monitor will get an access violation.
Component(s) affected:
perfmon.exe


Bug # 2583  Compaq Prosignia hangs scanning c710.
Description of bug:
Certain Compaq Prosignia machines fail setup.  The machine that was found to 
fail had a BIOS dated 4/8/93.  In every case of failure, the machine hangs 
and the floppy drive light stays on.
Component(s) affected:
ncrc710.sys


Bug # 2686  Trap A in Elnk16 NDIS driver with Services For Macintosh running
Description of bug:
The trap occurred after Mac services were installed and the "Welcome" screen 
was displayed.  This is a result of a hardware conflict between the Elnk16 
and the LPT1 port.
Component(s) affected:
elnk16.sys
elnkmc.sys
lance.sys
ndis.sys
ne3200.sys


Bug # 2706  Printer drivers have bugs (JP350.DLL & HPDSKJET.DLL).
Description of bug:
1. Only a small subset of resident fonts are enumerated in Apps. Some of 
   these print incorrectly. There is no font compatibility with Windows 3.1.
2. Graphics print speed is much slower than it should be.
Component(s) affected:
hpdskjet.dll
jp350.dll


Bug # 2708  Redirector can't connect LPT connection to 12-15 character 
server name.
Description of bug:
The Windows NT redirector would fail when attempting to connect to an LPT 
share on a server with a name between 12 and 15 characters 
(i.e., net use lpt1: \\longservername\printer).
Component(s) affected:
rdr.sys


Bug # 2720  NTVDM can't open COM port after terminal.exe uses it.
Description of bug:
NTVDM can't open a COM port that has the error character enabled.  
Unfortunately, terminal.exe sets an error character and the COM port 
settings are sticky across opens.  So NTVDM can't use any COM ports touched 
by terminal.exe unless another program has turned off the error character.
Component(s) affected:
ntvdm.exe


Bug # 2738  Hotkeys leak.
Description of bug:
When processing WM_HOTKEY events, the system allows the key event to pass
through to the application with the focus even though the hotkey was 
processed.
Component(s) affected:
winsrv.dll


Bug # 2757  Memory manager doesn't reset event when paging in executable.
Description of bug:
A paging event was not being reset correctly by the memory manager.
Component(s) affected:
ntoskrnl.exe
ntkrnlmp.exe


Bug # 2792  Terminal:  Alt key doesn't work.
Description of bug:
After connecting to another machine via telnet, the Alt key doesn't work 
within terminal.
Component(s) affected:
terminal.exe


Bug # 2801  32-bit driver returns 0 from GetDeviceCaps(NUMCOLORS).
Description of bug:
Paintbrush shows up black and white on a 32-bit display device as a result 
of the bug.
Component(s) affected:
ati.dll
framebuf.dll
jzvxl484.dll
wow32.dll


Bug # 2822  PortUAS maps non-English characters incorrectly.
Description of bug:
PortUAS was incorrectly mapping certain non-English characters (i.e., an 
'o-umlaut' was mapping to an 'a').
Component(s) affected:
portuas.exe


Bug # 2825  Print Manager traps if more jobs are added to a paused queue.
Description of bug:
1. Start Print Manager.
2. Send jobs to a local queue that has been paused.
3. Change the job order by highlighting the request with the cursor and 
   dragging and dropping the request (last job moved to the first position).
4. Add more jobs. These additional requests do not appear as queued 
   requests in the local window. Click on the white space where the entry 
   should be (i.e., below the last queued request) and "Untitled" appears 
   in the lower bar window.
5. Close and reopen Print Manager and click on the white space where the 
   additional requests should be (the same location as before).
6. A window appears, stating " Printman.exe - Application error. The 
   instruction at "0x01c78c0c" referenced memory at "0x00440030". The 
   memory could not be read." The system must be rebooted to clear this 
   state.
Component(s) affected:
localspl.dll


Bug # 2841  Spoolss.exe crashes when ENTER is hit twice in Appletalk dialog.
Description of bug:
With Windows NT Services for Macintosh installed and running, and a printer
created:
1. Start Print Manager.
2. Choose Printer/Properties...
3. Choose Print to:/Network Printers...
4. Select AppleTalk Printing Devices and choose OK.
5. Press ENTER to enumerate the zone.
6. Immediately press ENTER again.
7. Spoolss.exe application error occurs.
Component(s) affected:
sfmatalk.sys
sfmmon.dll
sfmprint.exe
sfmsrv.sys


Bug # 2844  NE3200 hangs open if issued during reset.
Description of bug:
System boot doesn't fully complete and the redirector and server don't get 
loaded, because one of the transports hangs during its load sequence.  This 
causes the service controller to hang, which causes lots of other things to 
hang.  This bug occurred only when the card was not connected to a network, 
or was on a very quiet network.
Component(s) affected:
ne3200.sys


Bug # 2849  Truncated display of NTFS partitions from non-Windows NT 
machines.
Description of bug:
Windows NT shows the wrong filecount on NTFS partitions in certain 
configurations when attempting to display files with umlauts.  It truncates 
the display after 8, 18, 28, 38, etc. files in alphabetical order.  
Directories will disappear as well.
Component(s) affected:
srv.sys


Bug # 2854  File server causing WFW clients to get sharing violations.
Description of bug:
A file-locking bug was causing WFW Access clients to get sharing violations.
Component(s) affected:
ntoskrnl.exe
ntkrnlmp.exe


Bug # 2866  Publisher 2.0 access violates in Printer browsing.
Description of bug:
1. Make sure at least one printer is defined in Print Manager.  If not, 
   create one.
2. Open Publisher 2.0.
3. Select File, Print Setup from the menu.
4. Choose the Network button.
Result: Access Violation
Component(s) affected:
winspool.drv


Bug # 2871  Writing to PAGE_EXEUTE_WRITECOPY page causes trap.
Description of bug:
A stress test of the Virtual APIs would cause a crash of the 
operating system on about the 9th iteration of an API.
Component(s) affected:
ntoskrnl.exe
ntkrnlmp.exe


Bug # 2877  SCSIPORT does not recognize device types > 7F.
Description of bug:
The SCSI port and class drivers needed to be modified to recognize SCSI 
devices with a device type greater than 7Fh.
Component(s) affected:
scsidisk.sys
scsiport.sys


Bug # 2923  Services For Macintosh:  Setup paths to files are hard-coded to 
setup drive
Description of bug:
Windows NT SFM Setup hard codes the path for all SFM files in the registry 
to the drive that happened to be the Windows NT system root drive when SFM 
was installed. This causes problems if another hard disk is added and 
Windows NT reletters the drives to accommodate the new drive.
Component(s) affected:
oemnadlm.inf
oemnadlt.inf
oemnxpsm.inf


Bug # 2940  Alt+Doubleclick gives property box despite restrictions being 
set.
Description of bug:
Even if the User Profile Editor has been used to lock down all possible 
access in Program Manager, Alt+Doubleclick on whitespace causes a properties 
dialog to come up for a program item, which allows the user to access the 
properties.
Component(s) affected:
progman.exe


Bug # 2947  OS/2 Subsystem:  SQL Server 4.2 faults.
Description of bug:
When starting SQL Server, the error "kistartup: no memory for non-network 
thread stacks (need 12288 bytes)" would be displayed.
Component(s) affected:
os2.exe


Bug # 2950  DOS clients report incorrect diskspace on 2 gig or more 
Windows NT volumes.
Description of bug:
The information reported back to the DOS client was too large for the 
operation performed on the client to determine available free space, so the 
client would report "0 bytes free."
Component(s) affected:
srv.sys


Bug # 2953  MSMAIL32 - can't attach filenames with extended characters.
Description of bug:
Extended characters in filenames would cause file operations to fail in both 
MSMAIL32 and SCHDPL32.
Component(s) affected:
demil32.dll


Bug # 2968  Stress causes system_service_exception on NTFS.
Description of bug:
Stress had been run on a MIPS server when this error occurred.
Component(s) affected:
ntfs.sys


Bug # 2976  Unterminated DEC LANCE adapter crashes Windows NT.
Description of bug:
Using the LANCE.SYS driver on a DEC Etherworks Turbo adapter and by 
unplugging and plugging the Ethernet cable, the system will crash with an 
"Out of System PTEs" crash code.
Component(s) affected:
elnk16.sys
elnkmc.sys
lance.sys
ndis.sys
ne3200.sys


Bug # 3004  Idle time calculation anomaly
Description of bug:
Currently, some amount of used CPU time can be applied as idle time.
This causes an unacceptable discrepancy for applications such as
Performance Monitor.
Component(s) affected:
ntoskrnl.exe
ntkrnlmp.exe
hal*.dll


Bug # 3018  Pro Audio Spectrum 16 CD audio cable doesn't work with 
Windows NT driver.
Description of bug:
No audio is output when playing an audio CD from CD Player or
Media Player within Windows NT when using a CD-ROM drive
connected to a Media Vision Pro Audio Spectrum 16 sound card.
Component(s) affected:
mvaudio.sys


Bug # 3084  Publisher package Change Icon crashes WOW.
Description of bug:
Create a package with Packager, and then choose Copy Package to get it in 
Clipboard. In Publisher 2, choose Edit Paste Object to paste package into 
document. Then choose Edit Package and Object Convert, click the "Display as 
Icon" button, and the "Change Icon" button appears.  Click the "Change Icon" 
button, and WOW crashes.
Component(s) affected:
krnl286.exe
krnl386.exe


Bug # 3092  Redirector sets date and time incorrectly to LM 2.x server.
Description of bug:
The redirector currently has a bug that causes it to set the time 
on files incorrectly on an LM 2.x Ring 3 and Ring 0 server.  This problem 
does not occur on all servers.
Component(s) affected:
rdr.sys


Bug # 3098  RASPHONE:  Doesn't give right password for callback after change.
Description of bug:
1. Create account - check "User Must Change Password at Next Logon" box.
2. Give account RAS permission and callback.
3. Dial from RASPHONE and use that account.
4. During authentication, you will be prompted to change your password -
   change it.
5. When prompted for callback number, type in client's phone number.
6. While re-authenticating after the callback, you will get a bad
username/password error.
Component(s) affected:
rascauth.dll


Bug # 3102  Can read a locked region of a file on redirect.
Description of bug:
1. Create a file.
2. Write some data.
3. Lock half of the data.
4. hfile2 = Open the file.
5. ReadFile(hFile2)

The ReadFile from the second handle should fail as the data is locked.
Component(s) affected:
rdr.sys


Bug # 3131  Paged Pool leaks.
Description of bug:
A page pool leak was occurring when an API was being called with the 
IgnoreCase parameter set to TRUE.
Component(s) affected:
ntoskrnl.exe
ntkrnlmp.exe


Bug # 3160  Mup crashes with 2 redirectors.
Description of bug:
When 2 redirectors were loaded, the Mup component would crash.
Component(s) affected:
mup.sys


Bug # 3161  NCR video driver fails on fast machine.
Description of bug:
The NCR miniport driver fails on some faster machines due to a bug in the 
palette programming.
Component(s) affected:
ncr77c22.sys


Bug # 3171  Telnet crashes Services when exiting terminal program.
Description of bug:
There is a timing window in the telnet service that can cause the master
thread to delete the client's critical section before the client thread
terminates.  This occurs if the terminal program closes just before the 
master tries to write the telnet> prompt.  The master's write then fails, 
causing it to error out and delete the critical section.  The client's read 
then fails, causing it to try to access the critical section during its 
termination processing.  The client thread then access violates.
Component(s) affected:
telnet.dll


Bug # 3175  Browser Monitor crashes NBT.
Description of bug:
While running the Browser Monitor, an NBT bug that is caused by
referencing through a freed pointer can be exposed.  Normally, this is 
fairly benign. However, if the pool of memory backing the pointer is freed, 
the system will crash.
Component(s) affected:
nbt.sys


Bug # 3209  Mail from WINFILE crashes when auto spell-check is on.
Description of bug:
From Mail32, turn on the automatic spell-check (under <mail><options>), and
then try to mail a message from File Manager.  At the point at which the
spelling check is attempted, an application exception occurs.  Dr. Watson
generates a log:
	WINFILE.exe
	Exception: access violation (0xc0000005), Address: 0x77da22f6
Component(s) affected:
demil32.dll


Bug # 3215  Swedish privilege text is incorrect.
Description of bug:
Some of the privilege names were incorrect.
Component(s) affected:
msprivs.dll


Bug # 3231  Ndis: Ndis API does not free buffer.
Description of bug:
An Ndis API does not free the buffer that it allocated to hold the
image that was read in.
Component(s) affected:
ndis.sys


Bug # 3242  Can't copy >4 GB file from Windows NT to Windows NT.
Description of bug:
It was reported that the SQL dump utility was unable to dump (back up) an 
8 GB database across the net.  The transfer fails after copying 4 GB.
Component(s) affected:
rdr.sys


Bug # 3244  Services For Macintosh:  SID/Name cache entries are not getting 
aged out.
Description of bug:
When a user account is deleted, if SFM has a SID/name entry in its cache for
that user, it should get aged out of the cache after 5 minutes if there is 
no access to the pair.
Component(s) affected:
sfmsrv.sys


Bug # 3245  Services For Macintosh:  Can't move items from same volume to 
locked folder.
Description of bug:
When setting the locked box on a folder (read-only bit on Windows NT), 
dragging files or folders is not possible from the same Mac volume to the 
locked folder.  You can, however, drag files or folders from another volume 
on the same server, a different server, or your Mac HD to the locked folder.
Component(s) affected:
sfmsrv.sys


Bug # 3251  NPFS: Calling a pageable function while holding spinlock
Description of bug:
The bug is in an API that is obtaining a spinlock, and then calling a 
pageable function.
Component(s) affected:
npfs.sys


Bug # 3260  Two Net cards do not work for TCP.
Description of bug:
An uninitialized variable prevents dual net cards from working.  This 
problem only occurs if the last octet of the IP address of the second net 
card is greater than 127.
Component(s) affected:
tcpipsvc.dll


Bug # 3263  SetCaret API does not work correctly in multi-threaded Win32 
applications.
Description of bug:
Code with the following logic would fail:
Thread 1:  Creates a window and starts another thread.
Thread 2:  Uses an API to synchronize the two threads' "Input State", 
attempts to write to the window of Thread 1, and then tries to set the 
caret via SetCaret().
Component(s) affected:
winsrv.dll


Bug # 3282  Registry string that ends at page boundary causes fault.
Description of bug:
If a registry string ends exactly at a page boundary, a fault will occur.
Component(s) affected:
ntoskrnl.exe
ntkrnlmp.exe


Bug # 3299  Ndis.sys crashes on MIPS machines.
Description of bug:
This crash was due to some alignment problems.
Component(s) affected:
ndis.sys


Bug # 3348  Server crashes while processing a LAN Manager API.
Description of bug:
A machine running a particular LAN Manager API on a remote Windows NT server 
would cause the Windows NT system to crash.
Component(s) affected:
netrap.dll
xactsrv.dll


Bug # 3353  Browser access violates while classifying an illegal datagram.
Description of bug:
There is a bug in the browser.sys driver that can occur when processing an
illegal datagram on streams transports.  If the datagram passed in is 
shorter than will fit in a valid transaction SMB, the browser will check 
beyond the end of the buffer, potentially access violating.
Component(s) affected:
browser.sys


Bug # 3372  Digiboard digifep5 driver can't load.
Description of bug:
Trying to load the Digiboard drivers (pcimac or digifep5) at valid I/O and
memory addresses results in a crash.
Component(s) affected:
dgconfig.dll
digifep5.dll
ntcx.dll
ntxall.sys
ntxem.sys
oemnadds.inf


Bug # 3377  NTFS doesn't correctly set archive bit.
Description of bug:
With an Access database running on an NTFS partition, the archive bit does 
not get set.  While doing a full backup, all archive bits were cleared.  
Access was then entered and several records were deleted from the database.  
Checking both in File Manager and with the Attrib command, it was noticed 
that the archive bit is not set.  This means that an incremental or 
differential backup will not back up this changed file.
Component(s) affected:
ntfs.sys


Bug # 3410  256 color does not work on some Toshiba portables.
Description of bug:
On many Toshiba portables, 256 color modes do not work.  When the machine is 
started, only some random color appears in the top part of the screen.  The 
only work around is to go back to 16 colors.
Component(s) affected:
wdvga.sys


Bug # 3412  Schdpl32 - data misalignment in access privileges
Description of bug:
Data alignment problems were causing a crash.
Component(s) affected:
msschd32.dll


Bug # 3421  Bug in Memory Manager causes crash.
Description of bug:
There was a bug in one of the memory management routines that probes and 
locks pages. It was an anomaly that this routine was called without also 
calling probe for read/write.
Component(s) affected:
ntoskrnl.exe
ntkrnlmp.exe


Bug # 3426  CDFS crash; Unhandled Kernel exception crash
Description of bug:
Machine crashed to blue screen.  One crash indicated CDFS_FILE_SYSTEM
had crashed.  Second crash indicated:

	Stop: 0x0000001E (0xC0000005, 0xFCB10CCF, 0x00000000, 0x00000015)
	Unhandled kernel exception C0000005 from FCB10CCF (0,15)
	Address FCB10CCF has base at FCB00000 - SFMSRV.SYS

Steps to reproduce:
1. Connect to a CD Mac volume on Windows NT Advanced Server (Build # 511) 
   from a Mac.
2. Go into a subdirectory.
3. Replace the CD on the Windows NT Advanced Server.
4. Select another file or subdirectory on the Volume on the Mac.
5. A message pops up on Windows NT Advanced Server asking for the right CD. 
   Click on Retry several times without changing the CD, and the system 
   crashes.
Component(s) affected:
cdfs.sys


Bug # 3429  NDIS Indications crash if no memory is available.
Description of bug:
If the API that allocates memory fails, an NDIS crash could occur.
Component(s) affected:
elnk16.sys
elnkii.sys
elnkmc.sys
ibmtok.sys
lance.sys
ubnei.sys


Bug # 3433  Restore loops endlessly when it has exactly 4GB more data.
Description of bug:
When doing a restore, NTBackup loops when it has exactly 4GB more data to
process.
Component(s) affected:
ntbackup.exe


Bug # 3435  Internal program access violates on exit under mail
Description of bug:
WOW was not setting the sound pointer correctly because of an uninitialized 
variable.
Component(s) affected:
wow32.dll


Bug # 3443  Visual Basic application crashes Windows NT
Description of bug:
The Windows NT machine freezes if a Visual Basic application uses 
MicroHelp's 3-D Gizmos version 2.10.  
Component(s) affected:
winsrv.dll


Bug # 3449  Novell WorkPlace TCP/IP connection hanging
Description of bug:
If a Novell WorkPlace TCP/IP client sends a large amount of data to a 
Windows NT server, it eventually will hang. This problem was noticed while 
testing a SQL Server Novell TCP/IP client.
Component(s) affected:
tcpip.sys


Bug # 3454  APIs do incorrect comparisons.
Description of bug:
Two port APIs were taking a parameter as an integer, but then doing 
comparisons of the integer against an unsigned short, which is incorrectly 
sign-extended.  This means that if a port or protocol number greater than 
127 is passed into these routines, then they will not return any information.
Component(s) affected:
wsock32.dll


Bug # 3455  Stamping Version Information on 16-bit GDI.EXE
Description of bug:
Version information needs to be stamped on 16-bit GDI.EXE.  Absence of this 
information from GDI.EXE causes MapInfo 2.1 to access violate.
Component(s) affected:
gdi.exe


Bug # 3463  4mm DAT does not work in 1K block mode.
Description of bug:
NTBackup fails to back up, reporting fatal hardware error on tape device, 
when set to 1k block mode transfers.
Component(s) affected:
4mmdat.sys


Bug # 3465  Low memory can cause USER APIs to return random values.
Description of bug:
When the API to create a window was called, it was returning a bad value.
Component(s) affected:
user32.dll


Bug # 3471  Wangtek 525 NMIs the system when running backup on MCA.
Description of bug:
The DMA controller times out and NMIs the system when performing odd
byte 16-bit data transfers.  This is most easily reproduced using the
Wangtek 525 tape drive and performing a backup on a system using 16-bit
slave DMA SCSI (NCR 3350/3410 with NCR53c9x.sys SCSI).
Component(s) affected:
halmca.dll


Bug # 3501  Fatal System Error caused by proteon.sys.
Description of bug:
The Proteon NDIS driver was causing a fatal error under stress.
Component(s) affected:
ndis.sys


Bug # 3506  WOW32 access violation
Description of bug:
When running internal test suites for WinSock, some tests calling an API 
with NULL pointers would either access violate, or have too large of a value 
returned from the API.  
Component(s) affected:
wow32.dll


Bug # 3516  Access violation in Lsa API
Description of bug:
A redundant line of code would cause an access violation in lsass.exe.
Component(s) affected:
lsasrv.dll
lsass.exe


Bug # 3517  Bad loop counter in NCR miniport driver
Description of bug:
A loop variable in the NCR miniport driver is defined as UCHAR, but the 
value can go up to 256, which causes problems. This has ill affect when 
trying to save and restore DOS apps.
Component(s) affected:
ncr77c22.sys


Bug # 3527  S3 (#9 only) drivers have vertical scan rates reversed.
Description of bug:
Windows NT version 3.1 has mislabeled the video drivers for the
S3 (#9) drivers.  When requesting the 72Hz driver, the 60Hz driver
is loaded.  When requesting the 60Hz driver, the 72Hz driver is loaded.
Component(s) affected:
s3.sys


Bug # 3528  Trap A running CD-ROM stress on a multi-processor machine
Description of bug:
Under extreme stress, a race condition was exposed that would cause a crash 
in CDFS.
Component(s) affected:
cdfs.sys


Bug # 3578  Schdpl32 data misalignment
Description of bug:
Data alignment problems were causing problems in Schedule Plus.
Component(s) affected:
msschd32.dll


Bug # 3581  PortUAS: add /log:filename switch
Description of bug:
A "/log:filename" switch was added to the PortUAS command line.
Component(s) affected:
portuas.exe


Bug # 3584  OEMNADNF.INF complains no Files-NETFLX section
Description of bug:
The Compaq NetFlex and DualSpeed adapter installation can be picked from 
the Control Panel-Network Add Adapter list, but the following error message 
occurs and the setup aborts (this occurs only on MIPS):
	"The INF OEMNADNF is missing the referenced file
	description section [Files-NETFLX]"
Component(s) affected:
filelist.inf
oemnadnf.inf
winperms.txt


Bug # 3587  Mac printing to Windows NT Advanced Server machine causes 
blue screen.
Description of bug:
Spooled two print jobs to a PostScript printer served by Windows NT 
Advanced Server Print Manager and Services for Macintosh.  A number of 
errors appeared:

Window Title: System Process - LostDelayed-Write Data
Window Contents: System was attempting to transfer file data from buffers to
	\Device\Harddisk1\Partition1\$Mft
		The write operation failed, only some of the data may have 
		been written to the file

After reboot, the same two print jobs were resent, and this time the system 
crashed.
Component(s) affected:
sfmatalk.sys
sfmwshat.dll


Bug # 3613  Acer MIPS system needs more map registers
Description of bug:
The number of map registers was increased for the Acer MIPS HAL.
Component(s) affected:
halacr.dll


Bug # 3633  FTPSVC: use of wildcard port results in denial of service.
Description of bug:
Internet firewall gateways are configured to disallow remote TCP connection 
requests from systems using non-reserved ports.  The Windows NT FTP Service 
is bound to a wildcard port when connecting to the client, which fails in these 
scenarios.  On the client side, any commands like 'ls' or 'get' hang, or 
eventually time-out.
Component(s) affected:
ftpsvc.exe


Bug # 4462  Certain WOW apps GP fault during shutdown.
Description of bug:
In certain cases during the start or shutdown of a WOW application, a GPF 
would occur in krnl386.exe - particularly in 16bit OLE2 enabled applications.
Component(s) affected:
krnl386.exe