Read the slapo-dynlist(5) manpage, especially the note about the manageDSAit control. Then check the slapd packet trace and see what controls the webapp is sending with the search request.
About the controls:
Wireshark told me the managedsait control is not sent by the webapp ldap client and not by the ldapsearch (without -M). I never used -M.
The webapp sends the control "pageresultcontrol" , size 500 to slapd. The slapd response back to the client "pageresultcontrol" size 0.
The slapo-dynlist(5) manpage already documents that pagedresults doesn't work with dynlist.
I switched off pagedresults control in slapd and get resultcode "adminLimitExceeded" and also 0 search result for the client. So this makes no difference for the client webapp.
Do i have to switch off pagedresults on all client which sent pagedresult control ? Or could i solve this on slapd ?