Linux – How to enable anonymous access to a Samba share under ADS security mode

I'm trying to enable anonymous access to a single service in my Samba config. Authorized user access is working perfectly, but when I attempt a no-password connection, I get this message:

Anonymous login successful
Domain=[...] OS=[Unix] Server=[Samba
3.3.8-0.51.el5] tree connect failed: NT_STATUS_LOGON_FAILURE

The message log shows this error:

... smbd[21262]: [2010/05/24 21:26:39,  0] smbd/service.c:make_connection_snum(1004)
... smbd[21262]:   Can't become connected user!

The smb.conf is configured thusly:

[global]
   security = ads
   obey pam restrictions = Yes
   winbind enum users = Yes
   winbind enum groups = Yes
   winbind use default domain = true
   valid users = "@domain admins", "@domain users"
   guest account = nobody
   map to guest = Bad User

[evilshare]
   path = /evil/share
   guest ok = yes
   read only = No
   browseable = No

Given that I have 'map to guest = Bad User' and 'guest ok' specified, I don't understand why it is trying to "become connected user". Should it not be trying to "become guest user"?