I'm losing my mind here, so I'm sure it's some dumb little mistake.

Works fine in our production network with 3.5.0

I have an exact copy of the eDir/LDAP tree in a test lab (and I mean
literally we imaged the server, none of this ldap import/export

I setup IDM 3.5.1 in the test lab and configured the UserApp the exact
same way I did for 3.5.0

I've double-checked the docs for "anonymous" search.

You can access the search anonymously, but when you submit a search, you
always get zero results (unless you login to the userapp)

Userapp is setup to use Public Anonymous Account

The [public] object is of course, the same in both trees (because it's
the same exact tree, at least at the time it was imaged).

What am I missing here? (i'm sure it's some dumb obvious thing).