I can recreate this with one of my instances of the repository but not my second one. Is this the same case for you (only one instance is getting the wrong permissions). I'll try to hunt down why this is happening tonight.

Here's what I've found in my testing. The correct information is getting written to the database so the permissions are being set properly (ie: the groups you've selected are the only ones written to the db when you click update). What I haven't been able to figure out is why, when you go back into the settings, you're getting extra groups checked. I'll get with Steve to have a look at this if I can't find it myself.