The only two callers that pass a root_dir_fid != 0 are reply_ntcreate_and_X() and call_nt_transact_create(). Both functions pass the relative wirename to filename_convert() which is wrong it is relative to root_dir_fid so filename_convert() will not be able to stat() the relative path and it's components. As the only test I can find that uses a root dir_fid is raw.samba3rootdirfid and that uses a handle on the share root which will work, the relative name hits the "creating file" codepath in unix_convert(), so the special testcase covered by the test works. Have patch, need bugnumber...
This landed a year ago...