Windows 2008 encodes the search list with the length of each search domain, termating the list with a NULL. The correct behavior is to encode the length of each search domain label, and terminate each search domain with a NUL.
For example, using the search domains "its.psu.edu" and "psu.edu" -
Windows 2008 encoding:
0b (length = 11)
69 i
74 t
73 s
2e .
70 p
73 s
75 u
2e .
65 e
64 d
75 u
07 (length = 7)
70 p
73 s
75 u
2e .
65 e
64 d
75 u
00 NUL
The correct encoding is:
03 (length = 3)
69 i
74 t
73 s
03 (length = 3)
70 p
73 s
75 u
03 (length = 3)
65 e
64 d
75 u
00 NUL
03 (length = 3)
70 p
73 s
75 u
03 (length = 3)
65 e
64 d
75 u
00 NUL
Quoting from RFC 1035, section 3.1:
"Domain names in messages are expressed in terms of a sequence of labels. Each label is represented as a one octet length field followed by that number of octets. Since every domain name ends with the null label of the root, a domain name is terminated by a length byte of zero."
Windows does not conform to this standard. It encodes the length of the domain, not of the labels in each domain.