Changing an ACL should generate a FILE_NOTIFY_CHANGE_SECURITY notification. Looks like the code to trigger this was never added to smbd.
Oh good catch. Should be only one place that needs changing, set_sd() inside source3/smbd/nttrans.c.
(In reply to Jeremy Allison from comment #1) Yup. Plus some basic smoke tests.