As per upstream advisory:

Samba implements DCE/RPC, and in most cases it is provided over and protected by the underlying SMB transport, with protections like 'SMB signing'.

However there are other cases where large DCE/RPC request payloads are exchanged and fragmented into several pieces. If this happens over untrusted transports (e.g. directly over TCP/IP or anonymous SMB) clients will typically protect by an explicit authentication at the DCE/RPC layer, e.g. with
GSSAPI/Kerberos/NTLMSSP or Netlogn Secure Channel.

Because the checks on the fragment protection were not done between the policy controls on the header and the subsequent fragments, an attacker
could replace subsequent fragments in requests with their own data, which might be able to alter the server behaviour.