Lustre supplementary group handling (without identity upcall) is incomplete and return unexpected EPERM. This is already known to be an issue with ACLs (i.e. "to support suppgid for ACL, we enable identity_upcall by default, otherwise, maybe got unexpected -EACCESS"). But in normal DNE contexts, this issue can still manifest if the client gets confused about the correct supplementary group to send. In some cases, Lustre has a rudimentary retry mechanism to attempt to supply the correct group. But this can still fall short. NFS, on the other hand, will send up to 16 groups - lessening the chance of this error. So modify Lustre's handling to retry a little harder.