As mentioned in my thread on the mailing lists there is a GPO entitled "sysvol share compatibility" which has the following blurb: This setting controls whether or not the Sysvol share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier applications. When this setting is enabled, the Sysvol share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission. When this setting is disabled or not configured, the Sysvol share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission. By default, the Sysvol share will grant shared read access to files on the share when exclusive access is requested. Note: The Sysvol share is a share created by the Net Logon service for use by Group Policy clients in the domain. The default behavior of the Sysvol share ensures that no application with only read permission to files on the sysvol share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the Sysvol share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the Sysvol share on the domain will be decreased. The last part is the most interesting (after 'Note:'). Is this how samba works too when it comes to providing the sysvol share?
The text you cite from the GPO sounds like that Windows has an exception for share modes for sysvol. I did not know this is even possible in Windows. Do you have more information on this, like a pointer into Microsoft docs? If it's share modes, then this is not what you see: An open failed due to share modes would give NT_STATUS_SHARING_VIOLATION, not NT_STATUS_ACCESS_DENIED.
Unfortunately, I don't have any further information on this. I did not know it was possible either but it would suggest that sysvol has some kind of hardcoded override on readonly locks. I don't have any Windows Servers to test that theory unfortunately. Thanks for confirming that if this is an issue it's not the cause of my problem with GPOs, I will post a separate bug report for that later!