Steps to produce:
1) Install OpenDJ with test users.
2) Run a search:
(mail should have an equality index and 'test\ff' is invalid because \ff isn't allowed in an IA5String)
If user has unindexed-search privilege, every entry will be checked even though it's certain that nothing will match.
If user hasn't got the unindexed-search privilege, they will receive:
In 2.6.x this behaviour was different, the invalid filter would evaluate to an empty result set rather than completely unindexed.
A quick initial debug shows that the following change would revert the behaviour (in this case) back to match 2.6.x: