Inside OpenDir() we have:

struct smb_Dir *OpenDir(TALLOC_CTX *mem_ctx,
                        connection_struct *conn,
                        const struct smb_filename *smb_dname,
                        const char *mask,
                        uint32_t attr)
{
        struct files_struct *fsp = NULL;
        struct smb_Dir *dir_hnd = NULL;
        NTSTATUS status;

        status = open_internal_dirfsp(conn,
                                      smb_dname,
                                      O_RDONLY,
                                      &fsp);
        if (!NT_STATUS_IS_OK(status)) {
                return NULL;
        }
        dir_hnd = OpenDir_fsp(mem_ctx, conn, fsp, mask, attr);
        if (dir_hnd == NULL) {
                return NULL;
        }

        /*
         * This overwrites the destructor set by smb_Dir_OpenDir_destructor(),
         * but smb_Dir_OpenDir_destructor() calls the OpenDir_fsp() destructor.
         */
        talloc_set_destructor(dir_hnd, smb_Dir_OpenDir_destructor);
        return dir_hnd;
}

The callers of OpenDir() then check errno if it returns NULL.

However, open_internal_dirfsp() is quite a complex beast, calling non_widelink_open and others. The NTSTATUS returned from open_internal_dirfsp() can become disconnected from errno, depending on the module stack. OpenDir_fsp() is very careful to set the correct errno on exit, OpenDir() needs to do the same.

Have patch, need bugnumber.