I think I'm on the trail of a bug here. The input looks good, the output looks slightly wrong.

Code:
<nds dtdversion="4.0" ndsversion="8.x">
  <source>
    <product edition="Advanced" version="4.6.0.0">DirXML</product>
    <contact>NetIQ Corporation</contact>
  </source>
  <input>
    <add cached-time="20171101145552.265Z" class-name="groupOfUniqueNames" dest-dn="cn=testgroup,ou=groups,dc=groups,dc=testcompany,dc=com" event-id="testbox1#20171101145552#99#1:a36d557f-c8de-4479-ec8e-7f556da3dec8" qualified-src-dn="O=testcompany\OU=groups\CN=testgroup" src-dn="\TREE\testcompany\groups\testgroup" src-entry-id="33457" timestamp="0#0">
      <add-attr attr-name="CN">
        <value naming="true" timestamp="1437515102#3698" type="string">testgroup</value>
      </add-attr>
      <add-attr attr-name="description">
        <value timestamp="1447093209#229" type="string">Testing Group</value>
      </add-attr>
      <add-attr attr-name="uniqueMember">
        <value timestamp="1447163048#186" type="dn">\TREE\testcompany\users\xxx123yyy</value>
        <value timestamp="1447195403#151" type="dn">\TREE\testcompany\users\kkk457bbb</value>
        <value timestamp="1452195202#63" type="dn">\TREE\testcompany\users\zzz456yyy</value>
        <value timestamp="1455737452#6" type="dn">\TREE\testcompany\users\rrr888ddd</value>
        <value timestamp="1466448457#77" type="dn">\TREE\testcompany\users\eee888sss</value>
        <value association-ref="uid=fbar,ou=na,ou=region,dc=users,dc=testcompany,dc=com" timestamp="1487419146#175" type="dn">\TREE\testcompany\users\foo222bar</value>
      </add-attr>
      <operation-data/>
    </add>
  </input>
</nds>
[11/01/17 10:55:52.650]:OUD-DV ST:Stripping operation data from input document
[11/01/17 10:55:52.650]:OUD-DV ST:OUD-DV: LDAPSub.performAddOperation() Calling getAllSups(groupOfUniqueNames)
[11/01/17 10:55:52.651]:OUD-DV ST:OUD-DV: LDAPSub.performAddOperation() \TREE\testcompany\users\xxx123yyy refers to an unassociated entry. It will be dropped.
[11/01/17 10:55:52.651]:OUD-DV ST:OUD-DV: LDAPSub.performAddOperation() \TREE\testcompany\users\kkk457bbb refers to an unassociated entry. It will be dropped.
[11/01/17 10:55:52.651]:OUD-DV ST:OUD-DV: LDAPSub.performAddOperation() \TREE\testcompany\users\zzz456yyy refers to an unassociated entry. It will be dropped.
[11/01/17 10:55:52.651]:OUD-DV ST:OUD-DV: LDAPSub.performAddOperation() \TREE\testcompany\users\rrr888ddd refers to an unassociated entry. It will be dropped.
[11/01/17 10:55:52.651]:OUD-DV ST:OUD-DV: LDAPSub.performAddOperation() \TREE\testcompany\users\eee888sss refers to an unassociated entry. It will be dropped.
[11/01/17 10:55:52.652]:OUD-DV ST:OUD-DV: LDAP Add:
dn: cn=testgroup,ou=groups,dc=groups,dc=testcompany,dc=com
uniqueMember:
uniqueMember: uid=fbar,ou=na,ou=region,dc=users,dc=testcompany,dc=com
description: Testing Group
CN: testgroup
objectclass: groupOfUniqueNames
objectclass: top
Note how the uniqueMembers attribute is being parsed out, unassociated user objects are being removed from the document, and the resulting LDIF has an extra, blank, uniqueMember in it. It works, but it looks "wrong" to have a uniqueMember that's blank.

Anybody seen this and a fix? I don't see any previous reports here in the forum, and searching Bugzilla hasn't turned up anything that looks like this one.

Engine is v4.6.0, shim is v4.0.1.0.