I believe you've nailed it.  I was overthinking the problem (see previous comment), then failing to consider that my first setuid($u) was negating my setuid/sgid bits that were allowing me to setuid(0) in the first place.