I guess this changed from 3.0.1 to 3.5?

If you mark an attribute as hide in the DAL, and the attribute is
actually selected to "hide" by the user, then ONLY a portal admin in
UserApp can edit that even if they ARE an Admin in the LDAP tree?

Very odd.

I thought that eDir rights were priority?