How does one reproduce this?

Create two IPA servers. Create an export of userRoot from server A, and use that to migrate to server B (offline migration).

For those in the future, to grab and import an LDIF:

# systemctl stop dirsrv.target
# dsctl EXAMPLE-TEST db2ldif userRoot
# systemctl start dirsrv.target

The dump will be in /var/lib/dirsrv/slapd-EXAMPLE-TEST/ldif/EXAMPLE-TEST-userRoot-.ldif

To migrate using the file:

# ipa-migrate prod-mode remotehost.example.test -w password -n -f dump.ldif

Sorry to be clear in this case, I took the LDIF file from an ipa backup. I'm not sure if it impacts the ldif content or not.

ipa backup calls out to db2ldif so they should be identical.

master:

• 4b7235c8b307264d56ac3a3bcdbe85966aad8d8e ipa-migrate - do not migrate tombstone entries, ignore MidairCollisions, and krbpwdpolicyreference

ipa-4-12:

• 7fd4b940abd2084fd6ec7de73dfd68551fce73fe ipa-migrate - do not migrate tombstone entries, ignore MidairCollisions, and krbpwdpolicyreference