It also works when using constraint.c of OpenLDAP release 2.4.33. Maybe it's caused by fix for ITS#7418?