Never found the answer; it wasn't an ACL problem (file ACLs of the offending VM were identical to all other ones), probably something got stuck in the VM configuration.
Deleting the VM, re-creating it and re-attaching its VHDs completely fixed the problem.