Look at what the old fallback did on the wire. `GetValue()` serializes the control, and the target string has to go from UTF-16 to UTF-8 on the way [5]. A lone high surrogate such as `\uD800` has no scalar value to encode [6], so the encoder substitutes U+FFFD and emits its three UTF-8 bytes, EF BF BD [7]. The result is well formed BER, the server accepts it, and it returns a window around whatever position those bytes sort to in the result set [4][7]. Nothing in that exchange reports a problem, and the client that asked for one page gets another [7].
A surrogate pair is two UTF-16 code units standing for one scalar value [6]; cut a display name or a sort key at a fixed number of code units and you can land between the halves. That is the shape of bug the .NET 10 exception catches, and it catches it during serialization, before LDAP I/O [2]. So a `try`/`catch` wrapped around the request itself will not contain it. The author of the dev.to walkthrough treats the exception as input validation surfacing at the correct boundary rather than as an LDAP server failure [16], and his remedy is to trace the value back to its source, validate there, and keep the boundary test so a later refactor cannot restore the permissive path by accident [14].
The probe is worth copying for its shape. Four inputs: ASCII, a valid surrogate pair, an unpaired high surrogate, an unpaired low surrogate; `GetValue()` called directly so BER serialization runs with no connection open; a hex scan of the serialized bytes for EFBFBD [10]. Two of those four inputs behave identically on both runtimes, which makes the other two the whole compatibility surface [15]. `Summary: 5/5 passed` [12] is a claim about the author's harness. For the split to reproduce in yours, the VLV target has to arrive as a .NET string from a path that can emit a lone surrogate [5][6], and you have to be on the pairing he pinned: net10.0 with System.DirectoryServices.Protocols 10.0.11 [9].
The experiment also moves two variables together. Package versions are pinned per target framework, 9.0.19 for net9.0 and 10.0.11 for net10.0 [9], so it demonstrates the .NET 9 to .NET 10 delta as shipped without isolating whether the behaviour changed in the runtime or in the library. The counting is loose in one place too: the post describes six assertions per target and a verifier that ends at 5/5 [11][12], and those are not the same axis. Neither point weakens the finding, and the harness has the property that decides whether anyone adopts it, which is that it needs no directory, no credentials and no runtime network access [12]. A compatibility test with no server to provision is one that might actually get run. Microsoft documents the strict encoding behaviour in a .NET 10 LDAP compatibility note, according to the same post [8]. In my context I would take the throw and pay the migration cost: a paging control that seeks to an unintended position is more expensive to diagnose than an exception at the call site [3][7].
