does this help? the "7" in 172 is something else (octal 267, I believe).

Precisely. How did that get in my database? It MUST match the dn per spec, right? And it doesn't.

(The character almost certainly should be '7.' If I go back in my logs far enough, I'll bet I can even find an ADD log showing it as such...)