Due to a mix-up with the fsp->is_directory flag, ACLs set on directories would not stick, and so would cause 'samba-tool ntacl sysvolcheck' to fail. The failure was odd, as the ACL would just revert back to the mapping of the underlying posix ACL, and the hash wouldn't match. Investigation showed some ACEs are only added for directory ACLs. Patches are on samba-technical awaiting comment.
Fixes for this are in master, and in the mega-patch in bug #9406 for 4.0.
Should be fixed in Samba 4.0.0rc6. Please feel free to re-open if it's still an issue. Thanks!