I know this is old code, but based on the canonical DACL business, this is not right IMHO.  Should be something like

```ruby
sd.dacl.findall { |ace| ace.type == ACCESS_DENIED_ACE_TYPE }.each do |ace|
  add_access_denied_ace(acl, ace.mask, ace.sid)
end

sd.dacl.findall { |ace| ace.type == ACCESS_ALLOWED_ACE_TYPE }.each do |ace|
  add_access_allowed_ace(acl, ace.mask, ace.sid, ace.flags)
end
```

Even that isn't technically correct because it doesn't take into account inheritance.

Whether or not we want to change that now, or add a new ticket I'll leave to your discretion (no pun, really!)