3.2.4.5.2 FID Permissions

If the open operation that created the FID specified a Deny mode, any SMB session making use of the FID (other than the SMB session within which the FID was created) has only the set of access rights determined by performing a logical "and" on the open mode rights and the Deny mode rights. That is, the Deny mode is checked on all file accesses.