Jeremy, here's a nice one: our root_dir_fid code for SMB1 is completely broken. This MR fixes it and then also removes the root_dir_fd arg from SMB_VFS_CREATE_FILE().
The only two callers that pass a root_dir_fid != 0 are reply_ntcreate_and_X() and call_nt_transact_create(). Both functions pass the relative wirename to filename_convert() which is wrong it is relative to root_dir_fid so filename_convert() will not be able to stat() the relative path and it's components.
As the only test I can find that uses a root dir_fid is raw.samba3rootdirfid and that uses a handle on the share root which will work, the relative name hits the "creating file" codepath in unix_convert(), so the special testcase covered by the test works.
Note: the last patch of the series is for master only.