It this comment no longer a concern?  What happens now when a default ACL is queried on a directory with no default ACL entries?  It looks like an invalid ACL object would get used below.