The problem is we're calling get_kdc_ip_string() which calls netlogon_pings() to contact the secondary DC (we already have a working connection to a "first" DC) and netlogon_pings() returns an error if all DCs it was supposed to ping fail to respond. This causes get_kdc_ip_string() to return an error causing complete idmapping failure.