I'm pretty sure this patch will fix the problem John Hodrien had with
dereference code, although I have not reproduced the problem using
referrals as he did, but simpler:
i) use the dereference code, but process a group that is below the full
deref threshold (<10 members by default)
ii) one of its members is neither user nor group and is not cached
iii) the dereference code always tries to move the "expired group index"
not the "missing DN index" so the missing DN array never reaches the