It shouldn't happen that a SID can be allocatable from the pool of a DC (even manually as happens in the 'samba-tool domain backup online' command) and be a duplicate, but such things can happen if RID master roles are stolen around. This currently gives a traceback with warnings from the unique index code in LDB.
This bug was referenced in samba master: 15609cb91986b3e29c5b1a3b6c69c04829f43eb4
This bug was referenced in samba master: 8ad82ae66157c893a2b84d353ec4d9feb4815ede
This bug was referenced in samba v4-13-test: 6e284db78779aae20b49300ae304c5b643f31b7d d0bde5703b25fb34a0b672422c052909b1acbbef
This bug was referenced in samba v4-13-stable (Release samba-4.13.10): 6e284db78779aae20b49300ae304c5b643f31b7d d0bde5703b25fb34a0b672422c052909b1acbbef