During robocopy jobs with /COPY:DAT, Windows clients are sending a mtime of 01/01/1980, which we are obligingly setting. utimensat(2) behavior is to replace the birth time with the second element of the times array if it is older than the current birth time. This means that the utimenset call replaces the birth time with the mtime received from the client (01/01/1980).