Troubles catching CAP_SYS_ADMIN?, and MAC questions

Amon why CAP_SYS_ADMIN gives so much troubles to get catched?, any others
doesn't get this troubles:

While testing cap_learning_mode:

203|capable(): pid 1901(dmesg), uid 0: add missing user max_cap NONE to
transaction 0
204|capable(): pid 1901(dmesg), uid 0: add missing user max_cap SYS_ADMIN
to transaction 0

It seems system gets confused with CAP_SYS_ADMIN capable questions

The second question:

I'm wrong if I think that accessing to SCD (sysctl) at a MODIFY_SYSTEM_DATA
way under MAC is permitted only to the global (non RC) admin role?
Why is not permitted to secoff role too?

Related to the ds-property, does MAC just check dac_permissions or does it
check also RC permissions? I think that only the first one is checked and
others hardcoded, it is?. If so, it's planned to get extended to RC access
control?. I think extending MAC to RC would be useful for example to permit
for example the role sysctl_r (and not global admin_r) to write proc
variables since MODIFY_SYSTEM_DATA is present in ds (so RC has permitted
role sysctl_r to modify_system_data to SCD sysctl, so ds-property check
passed)

What would happen in a scenary if DAC is disabled with MAC active?
ds-property always granted?