Once upon a time, I would have known the answer to your question off-the-top-of-my-head, but it's been years since I've "touched" a 68xx.
I recall (???), years ago using the then current IOS, they follow the old Cisco switch QoS model, i.e. ingress ports need to either have an explicit trust statement or an ingress policy, otherwise the switch will reset the ToS to zero.
I also recall (?) these switches worked a bit differently from other smaller Catalyst switches, on the latter, you had to enable QoS, if QoS wasn't enabled, ingress ToS wasn't changed. With the 65xx/68xx switches, I recall QoS was always enabled (which also means, you'll get different QoS treatment upon egress too, based on ToS marking).
You note the QoS MLS commands are deprecated on these models. If true, then if they're like the newer Catalyst switches, they wouldn't modify an ingress ToS marking, unless you've configured them to do so. However, unlike a router, I recall they will still do egress treatment for egress.
Possibly, if you check if ingress interfaces support the trust command, that might be a clue which QoS switch approach they use, old or new.
