Not getting correct group membership. There is a PAC processing problem in cross-domain group configurations with Windows 2012 DCs. The problem shows as a difference between the number of groups in the PAC and the count in the PAC header.
The following in vasd debug is indicates this issue:
libvas_auth_get_pac() failed, error = VAS_ERR_FAILURE: Unspecified failure#012 Coud not decode PAC#012 Caused by:#012 SYSERR--1: Unknown error 18446744073709551615
Setting msDS-SupportedEncryptionTypes to the value of 524319 turns off sid compression for the object. (Resource-SID-compression-disabled)