Not getting correct group membership. There is a PAC processing problem in cross-domain group configurations with Windows 2012 DCs. The problem shows as a difference between the number of groups in the PAC and the count in the PAC header.
Setting msDS-SupportedEncryptionTypes to the value of 524319 turns off sid compression for the object. (Resource-SID-compression-disabled)