diff --git a/librpc/idl/ioctl.idl b/librpc/idl/ioctl.idl
index 77606441737..d037956ab70 100644
--- a/librpc/idl/ioctl.idl
+++ b/librpc/idl/ioctl.idl
@@ -164,9 +164,13 @@ interface sparse
 	 * computed by dividing the size of the returned output buffer (from
 	 * either SMB or SMB2, the lower-layer protocol that carries the FSCTL)
 	 * by the size of the FILE_ALLOCATED_RANGE_BUFFER element.
+	 *
+	 * This logic can't (currently) be represented in pidl, so just use a
+	 * blob. Perhaps in future we'll support:
+	 *	[flag(NDR_REMAINING)] file_alloced_range_buf array[];
 	 */
 	typedef [public] struct {
-		file_alloced_range_buf *array;
+		[flag(NDR_REMAINING)] DATA_BLOB far_buf_array;
 	} fsctl_query_alloced_ranges_rsp;
 
 	/* 2.3.65 FSCTL_SET_ZERO_DATA Request */
diff --git a/source4/torture/smb2/ioctl.c b/source4/torture/smb2/ioctl.c
index 931a013b798..d04fb4962e4 100644
--- a/source4/torture/smb2/ioctl.c
+++ b/source4/torture/smb2/ioctl.c
@@ -2922,6 +2922,9 @@ static NTSTATUS test_ioctl_qar_req(struct torture_context *torture,
 			status = NT_STATUS_UNSUCCESSFUL;
 			goto err_out;
 		}
+		/* move to next buffer */
+		ioctl.smb2.out.out.data += sizeof(far_buf);
+		ioctl.smb2.out.out.length -= sizeof(far_buf);
 	}
 
 done: