For anyone else hitting this, also worth noting that basefiles generated on a system with messed up acls can have bad acls built in to them and they will need to be fixed / recreated in addition to putting a new tar in the nfsroot.
Alternate way of getting new tar that I used: On the fai server: cat >/etc/fai/apt/preferences <<'EOF' Package: tar Pin: release a=jessie-backports Pin-Priority: 500 EOF tee -a >/etc/fai/apt/sources.list <<'EOF' deb http://ftp.debian.org/debian jessie-backports main EOF then regenerated the nfsroot.
