Just to add another data point, we used Stefan's patch on samba-4.10.16-24 on RHEL 7.9 for our ancient NT4 domain, and it fixed the problem. The patch needed a small tweak to apply but it seems good. Thank you.