Bug in 4.6.8 user module - or have I confused myself?

I've been fiddling with the user module in 4.6.8, trying to make default roles behave a bit differently to normal. This code is in the user creation part of user_save():

foreach ($array['roles'] as $rid) {
db_query('INSERT INTO {users_roles} (uid, rid) VALUES (%d, %d)', $array['uid'], $rid);
}

But, unless I've really confused myself (and put bugs in my code!) at that point the array[roles] array is set up with the ID in the keys, not the value.

If you scroll up a bit to the user modification part of the code, it's the array keys that are used:

foreach (array_keys($array['roles']) as $rid) {

Which AFAICS is the correct way of doing it.

So new users always get a default role ID of 0 because of the way the INSERT statement above handles a role ID that is actually a text string. That entry appears in the users_roles table, but since there isn't a role with ID 0 it kind of goes unnoticed. The code in user_admin_create() says:

// Because the admin form doesn't have roles selection they need to be set to validate properly
$edit['roles'] = array(_user_authenticated_id() => 'authenticated user');

which appears to be trying to set the newly created user to have a role of "authenticated user". This never happens.

Alternatively, since I'm very new to Drupal, maybe I'm completely wrong... :o)