s4-ldb: ensure new dn_list elements are not owned by caller