Interaction of extendedKeyUsage and keyUsage

["Salz, Rich" <SalzR@xxxxxxxxxx>]

Hypotheses:
    1 if no KU extension is present, the cert can be used for "anything"
    2 if KU is present, the cert can only be used as specified by the bits
    3 if a particular OID appears in the EKU, the cert can be used as
      specified by that OID.
    4 if the OID does not appear -- or if the EKU is empty -- the cert
      cannot be used
Are those correct?
If so, what happens when #3 meets #1.  E.g., suppose a certificate has
id-kp-OCSPSigning in its EKU as specified by RFC2560. Must it have KU with
digitalSignature, as indicated by RFC2459?