I already found the solution to my problem but wanted to share to help ease someone else's pain should they encounter the same thing.

fact

Remote server running eDirectory 8.7.3.9


symptom

New server in the tree
Accounts are not getting inherited rights in DS or the filesystem
Denied creating folders when user has S or RWCEMF rights
Console Operators using Afreecon receive 895D errors - This requires console operator privileges - They are console operators.

DSRepair - Show Synchronization Status shows -251 errors talking to other servers (may or may not apply)

DSRepair - Advanced Options - Servers Known to the Database shows most or many servers as status 'unknown'

fix

In DSRepair - Advanced Options - Servers Known to the Database - select a listed server then select 'Repair all server addresses'

Once the server address repair is completed you may want to request an immediate DS complete self maintenance cycle including the Janitor process (this is the process responsible for registering inherited rights. If it has not run correctly the inherited rights will not be backlinked.

In general I will go ahead and order a complete DS synch and self maintenance cycle by issuing the following commands:
SET DSTRACE=ON
SET DSTRACE=NODEBUG
SET DSTRACE=*R
SET TTF=ON
SET DSTRACE=+S
set DSTRACE=*H
SET DSTRACE=+SCHEMA
SET DSTRACE=*SS
SET DSTRACE=*B
SET DSTRACE=*F
SET DSTRACE=*L

After it is allowed to run for some time (a minute on small servers or small networks, up to 20 minutes in larger environments) issue the commands:
set ttf=off
set dstrace=nodebug
set dstrace=off

If the problem persists check the following:
DSRepair - Check Synchronization Status
DSRepair - Check Timesync
Browse to sys:system and open dstrace.dbg. It is a text file that captured the results of the above dstrace commands. Search this file for any -7 or -6 occurrences (include the - character) Any errors other than -698 or -6015 should be investigated and resolved. At that time you may need to run the fix process again.
Note -698 and -6015 are not real errors but informational messages. (Replica in skulk - it basically means that the server it tried to talk to was already talking to someone else)

If one of our NTS folks wants to publish this as a TID.... It took me in excess of 4 hours chasing symptoms before I found the corrupt server address table inside DS.

I hope this saves someone else a bit of that troubleshooting time!