You didn't say what LDAP class your objects are.

I'm guessing that they're of type person or organizationalPerson

In which case, cn, although it contains numeric data, is declared within LDAP as a text attribute.

So your upper bound, "1000" when treated as a string, is less than your lower bound, "500".