By checking the key for the tell-tale DN=@IDX prefix we can discard the record without further work, making a massive performance improvement during a full scan. Patches due in master shortly.
Created attachment 15105 [details] Patch for 4.10
Patch doesn't apply cleanly to 4.9, so I won't bother going any further.
Comment on attachment 15105 [details] Patch for 4.10 This makes a big difference to full scan performance and so can be backported.
(In reply to Andrew Bartlett from comment #3) Pushed to autobuild-v4-10-test.
(In reply to Karolin Seeger from comment #4) Pushed to v4-10-test. Closing out bug report. Thanks!