It looks as though both AD and LDAP module cannot remove a value from a multi-valued attribute properly. AD doesn’t even have an option to remove a an attribute, and ldap errors when attempting to because it seems snaplogic sees an empty member list when checking for membership first. The reason it is empty looks to be in the way snaplogic obtains member attribute values, and does not populate the member attribute but populates it in the range attribute.
