The only two callers that pass a root_dir_fid != 0 are reply_ntcreate_and_X()
Both functions pass the relative wirename to filename_convert() which is wrong it is relative to root_dir_fid so filename_convert() will not be able to stat() the relative path and it's components.
As the only test I can find that uses a root dir_fid is raw.samba3rootdirfid and
that uses a handle on the share root which will work, the relative name hits the "creating file" codepath in unix_convert(), so the special testcase covered by the test works.
Have patch, need bugnumber...