One more thing.

I'm guessing that something about logging in directly (such as via telnet)
is triggering OpenVMS to synchronize the passwords between SYSUAF and LDAP.

I'm also guessing that what PMDF does to check the SYSUAF for the username
and password does not trigger OpenVMS to do that synchronization (PMDF
accesses the SYSUAF by calling SYS$GETUAI).