diff --git a/librpc/idl/samr.idl b/librpc/idl/samr.idl
index f57571f0e12..aa72c546a8f 100644
--- a/librpc/idl/samr.idl
+++ b/librpc/idl/samr.idl
@@ -1223,9 +1223,9 @@ import "misc.idl", "lsa.idl", "security.idl";
 		[in]        uint32 start_idx,
 		[in]        uint32 max_entries,
 		[in]        uint32 buf_size,
-		[out]       uint32 total_size,
-		[out]       uint32 returned_size,
-		[out,switch_is(level)] samr_DispInfo info
+		[out,ref]   uint32 *total_size,
+		[out,ref]   uint32 *returned_size,
+		[out,ref,switch_is(level)] samr_DispInfo *info
 		);
 
 	/************************/
diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c
index 25c160135b0..b81559bfcf2 100644
--- a/source4/rpc_server/samr/dcesrv_samr.c
+++ b/source4/rpc_server/samr/dcesrv_samr.c
@@ -4078,9 +4078,9 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo2(struct dcesrv_call_state *dce_call
 
 	result = dcesrv_samr_QueryDisplayInfo(dce_call, mem_ctx, &q);
 
-	r->out.total_size = q.out.total_size;
-	r->out.returned_size = q.out.returned_size;
-	r->out.info = q.out.info;
+	*r->out.total_size = q.out.total_size;
+	*r->out.returned_size = q.out.returned_size;
+	*r->out.info = q.out.info;
 
 	return result;
 }
diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c
index 0858b489448..8444ac38206 100644
--- a/source4/torture/rpc/samr.c
+++ b/source4/torture/rpc/samr.c
@@ -3803,6 +3803,9 @@ static bool test_QueryDisplayInfo2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 	bool ret = true;
 	uint16_t levels[] = {1, 2, 3, 4, 5};
 	int i;
+	uint32_t total_size;
+	uint32_t returned_size;
+	union samr_DispInfo info;
 
 	for (i=0;i<ARRAY_SIZE(levels);i++) {
 		printf("Testing QueryDisplayInfo2 level %u\n", levels[i]);
@@ -3812,6 +3815,9 @@ static bool test_QueryDisplayInfo2(struct dcerpc_pipe *p, TALLOC_CTX *mem_ctx,
 		r.in.start_idx = 0;
 		r.in.max_entries = 1000;
 		r.in.buf_size = (uint32_t)-1;
+		r.out.total_size = &total_size;
+		r.out.returned_size = &returned_size;
+		r.out.info = &info;
 
 		status = dcerpc_samr_QueryDisplayInfo2(p, mem_ctx, &r);
 		if (!NT_STATUS_IS_OK(status)) {