Test:

Create a file.
Add an ACE for DOMAIN Users: Deny ALL

Try to open the file for read: Denied. This is correct and the same as what W2K08 does.

Try to open the file with READ CONTROL: Denied. This is not correct. W2K08 allows the owner READ CONTROL in the presence of DENY entries for the same.

Thew problem is that in libcli/security/access_check.c we have this:

        /* the owner always gets owner rights as defined above */
        if (security_token_has_sid(token, sd->owner_sid)) {
                if (owner_rights_default)
                        /*
                         * Just remove them, no need to check if they are
                         * there.
                         */
                        bits_remaining &= ~(SEC_STD_WRITE_DAC |
                                            SEC_STD_READ_CONTROL);

                else {
                        bits_remaining &= ~owner_rights_allowed;
                        bits_remaining |= (owner_rights_denied &
access_desired);
                }
        }

        /* Explicitly denied bits always override */
        bits_remaining |= (explicitly_denied_bits & access_desired);

However, the manipulation of explicitly denied bits should happen before we do the OWNER RIGHTS check.