Glob ACLs are not working in AEM 6.0 with crx3

Hi,

I have applied ACLs with glob expressions in AEM 6.0 with crx3. Below is the scenario. 

1. Created a group and added below acl to /content level

<deny jcr:primaryType="rep:DenyACE" rep:principalName="private-users" rep:privileges="{Name}[jcr:read]" >
        <rep:restrictions jcr:primaryType="rep:Restrictions" rep:glob="/*" />
    </deny>

With above ACL, in <domain>/useradmin screen, "/content" node checkbox is checked and it childs are not checked,

2. Created child group to above created group and gave read access to some project in content. lets say content/geometrixx.

 With above, child group will have content and content/geometrixx nodes will be checked and all other childs of content will be unchecked.

3. Login to author instance with any user of second group created and navigate to <domain>/siteadmin.

I am expecting user should see "geometrixx" in siteadmin, but it is not showing

When we repeased the above steps in AEM 6.0 with CRX2 everything is working as expected.

Do we need to handle CRX3 differently than CRX2?