[Issue 9551] New: dnSubtreeMatch and others do not handle empty DN as asserted value