We have an odd case in production where a user was successfully, synced, but instead of having last_name, first_name as their display name as intended, the user's email address was used. The login name, which should be the email address, in turn is the IDP's cn.
I frankly have no idea how this can happen, because even if the data reported by LDAP was weirdly shuffled, the display name should at least contain a hard-coded comma. This can almost only be a Zitadel API bug.