It shouldn't happen that a SID can be allocatable from the pool of a DC (even manually as happens in the 'samba-tool domain backup online' command) and be a duplicate, but such things can happen if RID master roles are stolen around. This currently gives a traceback with warnings from the unique index code in LDB.
This bug was referenced in samba master: 15609cb91986b3e29c5b1a3b6c69c04829f43eb4
This bug was referenced in samba master: 8ad82ae66157c893a2b84d353ec4d9feb4815ede