I just posted the root cause analysis for the DNS RPC buffer overrun over on the SDL blog.