This was resolved by fixing a case sensitivity issue in our attribute resolution, but I'd still be curious to understand how or why subject canonicalization would even get involved and lookup wouldn't work. This is on 3.3 using the MFA scripting. The configuration -should- be a modification from stock 3.3.0.