Like in OpenGL and Direct3D 10+.

This test shows that first DACL entry that allows or denies access
should be used. The logic inside server for translating DACL to
permission is not matching it (always scans all DACL entries, deny
entries have bigger priority).