Answer
Treat this as expected re-verification work after an RLS implementation change, not necessarily a bug — re-run the relevant generation procedure for the affected security model and compare the actual combinations produced against your maximum/wildcard authority settings before assuming records are being silently dropped.