t appears that if a directory had the AD privilege, but not the WD privilege, then they would be able to create a directory but not a file in that directory.

Not so. To the best of my ability to verify this--it's a pain to do--there is no combination of inherited ACLs that will allow you to create a directory and then not be able to create a file within that directory.

The only circumstances I can envisage whereby this situation might come about without explicit setting of ACLs by the OP, is via Perl's emulation of the umask thing; or perhaps via cygwin's emulation of persistent umasks. But that all I can say on the subject as I'm not sufficiently conversant with the real thing to try and access whether the emulations are screwed or not.