Using the option -k on dbascan it's not trimming only the single register as expecting.

We can see it works on RH 8 DS-11:
 # dbscan -f /var/lib/dirsrv/slapd-rhds1/changelogdb/265bdd84-b89411ef-9b0ed831-db1b9827_675af13f000000020000.db -k 675af43f000000010000
   (result in a single register)RH 9 DS-12


However if fails on Rhel-9 using IPA or DS:
 # dbscan -f /var/lib/dirsrv/slapd-
ds12/db/userRoot/replication_changelog.db -k 675b377e000000010000
   (result in many registers after 675b377e000000010000, unless it's the last one) (edited)