Having a mooch through the code for Win32::FileSecurity it appears to not recognise ACCESS_DENIED_ACE_TYPE, which I guess is because it predates the Deny that came in with Windows 2000 NTFS

Win32::FileSecurity would need patching to enumerate denial ACE types. Unfortunately, my Win32 C++ 'skills' are not up to such a task.