[Samba] Is ACL+extended attributes exclusive with mask/mode family options?

[David Roid]

Hello list,

I've got a question from reading Using Samba 3rd, where it puts:

... the final permission is caculated by below filters in the order used by
Samba:
1. Apply any DOS attribute mapping options              << I take this as
either map DOS attributes to execute bits, or store DOS attributes in
extended attributes. Correct?
2. Apply the create mask settings
3. Apply the force create mode settings.

This looks reasonable, however I got an unexpected result from

[myshare]
path=...( file system is mount with acl and user_xattr )
writeble=yes
store dos attributes=yes
ea support=yes
vfs objects=acl_xattr
create mask=644

The problem is "create mask" is not honored and I get 755 for plain text
files created from windows client.

Further experiment reveals that if "vfs objects" is removed then "create
mask" works. I know vfs_acl_xattr is needed to keep windows ACL here ( I
suppose it's step1 ), but why doesn't it honor mask options ( step2 and
step3 )? Or settings in the share above are just not supposed to work
together?

Opinions?

Regards
-David