DSM-G600, DNS-3xx and NSA-220 Hack Forum

I've been looking to use my DNS-323 as a quick client show and tell dropbox, and have been using sFTP with good success.
Then I realized that sFTP access granted the user access to the whole contents of the drive, including other client folders. Not so hot.

So, based on some comprehensive study, including this forum, and here, and at least one cry of success, I've given it a shot.

The problem I'm having is that:

If I try to

Match User sftptest
     ChrootDirectory /home/sftptest
     ForceCommand internal-sftp
#    ForceCommand /ffp/libexec/sftp-server    #tried both of these
     AllowTcpForwarding no

I can still ssh into the box using other accounts, but user sftptest cannot.
Trying to sftp as sftptest, I get the following error

subsystem request failed on channel 0
Connection closed

If instead I use groups:

Match Group sftponly

and then restart /ffp/start/sshd.sh, the whole ssh system fails, and I have to Telnet in and comment out the Match lines to reactivate the openSSH system.

I'm using the subsystem call that was included in the ffp/etc/ssh/sshd_config file.

Subsystem       sftp    /ffp/libexec/sftp-server

Any thoughts?
Thanks,
Rob.