diff --git a/dlls/rpcrt4/ndr_clientserver.c b/dlls/rpcrt4/ndr_clientserver.c
index 34d68982dab..3aefab90d64 100644
--- a/dlls/rpcrt4/ndr_clientserver.c
+++ b/dlls/rpcrt4/ndr_clientserver.c
@@ -67,7 +67,7 @@ void WINAPI NdrClientInitializeNew( PRPC_MESSAGE pRpcMessage, PMIDL_STUB_MESSAGE
   pStubMsg->pPointerQueueState = NULL;
   pStubMsg->IgnoreEmbeddedPointers = 0;
   pStubMsg->PointerBufferMark = NULL;
-  pStubMsg->fBufferValid = 0;
+  pStubMsg->CorrDespIncrement = 0;
   pStubMsg->uFlags = 0;
   pStubMsg->UniquePtrCount = 0;
   pStubMsg->pfnAllocate = pStubDesc->pfnAllocate;
@@ -82,6 +82,13 @@ void WINAPI NdrClientInitializeNew( PRPC_MESSAGE pRpcMessage, PMIDL_STUB_MESSAGE
   pStubMsg->fHasReturn = 0;
   pStubMsg->fHasExtensions = 0;
   pStubMsg->fHasNewCorrDesc = 0;
+  pStubMsg->fIsIn = 0;
+  pStubMsg->fIsOut = 0;
+  pStubMsg->fIsOicf = 0;
+  pStubMsg->fBufferValid = 0;
+  pStubMsg->fHasMemoryValidateCallback = 0;
+  pStubMsg->fInFree = 0;
+  pStubMsg->fNeedMCCP = 0;
   pStubMsg->fUnused = 0;
   pStubMsg->dwDestContext = MSHCTX_DIFFERENTMACHINE;
   pStubMsg->pvDestContext = NULL;
@@ -127,6 +134,12 @@ unsigned char* WINAPI NdrServerInitializeNew( PRPC_MESSAGE pRpcMsg, PMIDL_STUB_M
   pStubMsg->fHasReturn = 0;
   pStubMsg->fHasExtensions = 0;
   pStubMsg->fHasNewCorrDesc = 0;
+  pStubMsg->fIsIn = 0;
+  pStubMsg->fIsOut = 0;
+  pStubMsg->fIsOicf = 0;
+  pStubMsg->fHasMemoryValidateCallback = 0;
+  pStubMsg->fInFree = 0;
+  pStubMsg->fNeedMCCP = 0;
   pStubMsg->fUnused = 0;
   pStubMsg->dwDestContext = MSHCTX_DIFFERENTMACHINE;
   pStubMsg->pvDestContext = NULL;
diff --git a/dlls/rpcrt4/tests/generated.c b/dlls/rpcrt4/tests/generated.c
index 9c4a5a778a0..609e49cbf25 100644
--- a/dlls/rpcrt4/tests/generated.c
+++ b/dlls/rpcrt4/tests/generated.c
@@ -412,7 +412,7 @@ static void test_pack_MIDL_STUB_MESSAGE(void)
     TEST_FIELD(MIDL_STUB_MESSAGE, struct NDR_POINTER_QUEUE_STATE *, pPointerQueueState, 44, 4, 4);
     TEST_FIELD(MIDL_STUB_MESSAGE, int, IgnoreEmbeddedPointers, 48, 4, 4);
     TEST_FIELD(MIDL_STUB_MESSAGE, unsigned char *, PointerBufferMark, 52, 4, 4);
-    TEST_FIELD(MIDL_STUB_MESSAGE, unsigned char, fBufferValid, 56, 1, 1);
+    TEST_FIELD(MIDL_STUB_MESSAGE, unsigned char, CorrDespIncrement, 56, 1, 1);
     TEST_FIELD(MIDL_STUB_MESSAGE, unsigned char, uFlags, 57, 1, 1);
     TEST_FIELD(MIDL_STUB_MESSAGE, ULONG_PTR, MaxCount, 60, 4, 4);
     TEST_FIELD(MIDL_STUB_MESSAGE, ULONG, Offset, 64, 4, 4);
diff --git a/dlls/rpcrt4/tests/ndr_marshall.c b/dlls/rpcrt4/tests/ndr_marshall.c
index ecb9f57f625..a860253ed5a 100644
--- a/dlls/rpcrt4/tests/ndr_marshall.c
+++ b/dlls/rpcrt4/tests/ndr_marshall.c
@@ -1164,7 +1164,7 @@ static void test_client_init(void)
     TEST_ZERO(pPointerQueueState, "%p");
     TEST_ZERO(IgnoreEmbeddedPointers, "%d");
     TEST_ZERO(PointerBufferMark, "%p");
-    TEST_ZERO(fBufferValid, "%d");
+    TEST_ZERO(CorrDespIncrement, "%d");
     TEST_ZERO(uFlags, "%d");
     /* FIXME: UniquePtrCount */
     TEST_ULONG_PTR_UNSET(MaxCount);
@@ -1186,8 +1186,15 @@ static void test_client_init(void)
     TEST_ZERO(fHasReturn, "%d");
     TEST_ZERO(fHasExtensions, "%d");
     TEST_ZERO(fHasNewCorrDesc, "%d");
-    TEST_ZERO(fUnused, "%d");
-    ok(stubMsg.fUnused2 == 0xffffcccc, "stubMsg.fUnused2 should have been 0xcccc instead of 0x%x\n", stubMsg.fUnused2);
+    TEST_ZERO(fIsIn, "%d");
+    TEST_ZERO(fIsOut, "%d");
+    TEST_ZERO(fIsOicf, "%d");
+    TEST_ZERO(fBufferValid, "%d");
+    TEST_ZERO(fHasMemoryValidateCallback, "%d");
+    TEST_ZERO(fInFree, "%d");
+    TEST_ZERO(fNeedMCCP, "%d");
+    TEST_ZERO(fUnused, "0x%x");
+    ok(stubMsg.fUnused2 == 0xffffcccc, "stubMsg.fUnused2 should have been 0xffffcccc instead of 0x%x\n", stubMsg.fUnused2);
     ok(stubMsg.dwDestContext == MSHCTX_DIFFERENTMACHINE, "stubMsg.dwDestContext should have been MSHCTX_DIFFERENTMACHINE instead of %d\n", stubMsg.dwDestContext);
     TEST_ZERO(pvDestContext, "%p");
     TEST_POINTER_UNSET(SavedContextHandles);
@@ -1258,7 +1265,7 @@ todo_wine
     TEST_ZERO(pPointerQueueState, "%p");
     TEST_ZERO(IgnoreEmbeddedPointers, "%d");
     TEST_ZERO(PointerBufferMark, "%p");
-    ok(stubMsg.fBufferValid == 0xcc, "fBufferValid should have been unset instead of 0x%x\n", stubMsg.fBufferValid);
+    ok(stubMsg.CorrDespIncrement == 0xcc, "CorrDespIncrement should have been unset instead of 0x%x\n", stubMsg.CorrDespIncrement);
     TEST_ZERO(uFlags, "%d");
     /* FIXME: UniquePtrCount */
     TEST_ULONG_PTR_UNSET(MaxCount);
@@ -1280,8 +1287,15 @@ todo_wine
     TEST_ZERO(fHasReturn, "%d");
     TEST_ZERO(fHasExtensions, "%d");
     TEST_ZERO(fHasNewCorrDesc, "%d");
-    TEST_ZERO(fUnused, "%d");
-    ok(stubMsg.fUnused2 == 0xffffcccc, "stubMsg.fUnused2 should have been 0xcccc instead of 0x%x\n", stubMsg.fUnused2);
+    TEST_ZERO(fIsIn, "%d");
+    TEST_ZERO(fIsOut, "%d");
+    TEST_ZERO(fIsOicf, "%d");
+    trace("fBufferValid = %d\n", stubMsg.fBufferValid);
+    TEST_ZERO(fHasMemoryValidateCallback, "%d");
+    TEST_ZERO(fInFree, "%d");
+    TEST_ZERO(fNeedMCCP, "%d");
+    TEST_ZERO(fUnused, "0x%x");
+    ok(stubMsg.fUnused2 == 0xffffcccc, "stubMsg.fUnused2 should have been 0xffffcccc instead of 0x%x\n", stubMsg.fUnused2);
     ok(stubMsg.dwDestContext == MSHCTX_DIFFERENTMACHINE, "stubMsg.dwDestContext should have been MSHCTX_DIFFERENTMACHINE instead of %d\n", stubMsg.dwDestContext);
     TEST_ZERO(pvDestContext, "%p");
     TEST_POINTER_UNSET(SavedContextHandles);
@@ -1799,6 +1813,7 @@ static void test_ndr_buffer(void)
     RPC_BINDING_HANDLE Handle;
     RPC_STATUS status;
     ULONG prev_buffer_length;
+    BOOL old_buffer_valid_location;
 
     StubDesc.RpcInterfaceInformation = (void *)&IFoo___RpcServerInterface;
 
@@ -1834,7 +1849,11 @@ static void test_ndr_buffer(void)
     ok(!StubMsg.BufferEnd, "BufferEnd should have been NULL instead of %p\n", StubMsg.BufferEnd);
 todo_wine
     ok(StubMsg.BufferLength == 0, "BufferLength should have left as 0 instead of being set to %d\n", StubMsg.BufferLength);
-    ok(StubMsg.fBufferValid == TRUE, "fBufferValid should have been TRUE instead of 0x%x\n", StubMsg.fBufferValid);
+    old_buffer_valid_location = !StubMsg.fBufferValid;
+    if (old_buffer_valid_location)
+        ok(broken(StubMsg.CorrDespIncrement == TRUE), "fBufferValid should have been TRUE instead of 0x%x\n", StubMsg.CorrDespIncrement);
+    else
+        ok(StubMsg.fBufferValid, "fBufferValid should have been non-zero instead of 0x%x\n", StubMsg.fBufferValid);
 
     prev_buffer_length = RpcMessage.BufferLength;
     StubMsg.BufferLength = 1;
@@ -1844,7 +1863,10 @@ todo_wine
     ok(RpcMessage.BufferLength == prev_buffer_length, "RpcMessage.BufferLength should have been left as %d instead of %d\n", prev_buffer_length, RpcMessage.BufferLength);
     ok(StubMsg.Buffer != NULL, "Buffer should not have been NULL\n");
     ok(StubMsg.BufferLength == 1, "BufferLength should have left as 1 instead of being set to %d\n", StubMsg.BufferLength);
-    ok(StubMsg.fBufferValid == FALSE, "fBufferValid should have been FALSE instead of 0x%x\n", StubMsg.fBufferValid);
+    if (old_buffer_valid_location)
+        ok(broken(StubMsg.CorrDespIncrement == FALSE), "fBufferValid should have been FALSE instead of 0x%x\n", StubMsg.CorrDespIncrement);
+    else
+        ok(!StubMsg.fBufferValid, "fBufferValid should have been FALSE instead of %d\n", StubMsg.fBufferValid);
 
     /* attempt double-free */
     NdrFreeBuffer(&StubMsg);
diff --git a/include/rpcndr.h b/include/rpcndr.h
index a0968d58ec2..9bf28407951 100644
--- a/include/rpcndr.h
+++ b/include/rpcndr.h
@@ -183,7 +183,7 @@ typedef struct _MIDL_STUB_MESSAGE
   struct NDR_POINTER_QUEUE_STATE *pPointerQueueState;
   int IgnoreEmbeddedPointers;
   unsigned char *PointerBufferMark;
-  unsigned char fBufferValid;
+  unsigned char CorrDespIncrement;
   unsigned char uFlags;
   unsigned short UniquePtrCount;
   ULONG_PTR MaxCount;
@@ -205,7 +205,14 @@ typedef struct _MIDL_STUB_MESSAGE
   int fHasReturn:1;
   int fHasExtensions:1;
   int fHasNewCorrDesc:1;
-  int fUnused:10;
+  int fIsIn:1;
+  int fIsOut:1;
+  int fIsOicf:1;
+  int fBufferValid:1;
+  int fHasMemoryValidateCallback:1;
+  int fInFree:1;
+  int fNeedMCCP:1;
+  int fUnused:3;
   int fUnused2:16;
   DWORD dwDestContext;
   void *pvDestContext;