As Thurallor pointed out, you should set the masking image mouse visible false so that mouse interaction passes through to the control beneath it. If there is only one control beneath the mask and the mask doesn't cover more area than the control then you should indeed set the mask as a child of the control for simplicity (position and zorder can be left at defaults). Position and ZOrder can become relevant if you want the mask to be larger than the control under it such as using one image to mask a grid of controls in which case you would not set the mask as a child of the control. You would still set the mouse visibility of the mask false though as you need the mouse events to pass to the control under the mask.

FWIW, there were some issues with quickslots not firing mouse events but I believe those were all ironed out in the last real Lua bug fixes back in 2014.