CONNECT_OPTIONS and oversized requests to bpcd.exe buffer overflows.
vulners.com/securityvulns/securityvulns:doc:15391
vulners.com/securityvulns/securityvulns:doc:15392