slapd 2.1.22 segfaults with subordinate and sasl

[Tom Riddle <ftr@highstreetnetworks.com>]

I am experiencing a segfault in slapd configured with a subordinate backend:

datebase ldbm
suffix "ou=nyc,o=xyz"
subordinate
...

datebase ldap
suffix "o=xyz"
uri ldap://serverA
...

When I try:
% ldapsearch -Y digest-md5 -U user1 -b 'ou=nyc,o=xyz' -s sub -LLL 
'(objectclass=*)'

The debug log says:
slap_sasl2dn: performing internal search (base=ou=nyc,o=xyz, scope=2)
ldap_create
ldap_url_parse_ext(ldap://serverA)

Why is it trying to connect to serverA ?  Looking at the code we see:
in slap_sasl2dn(), severs/slapd/saslauthz.c line 609:

   /* Must do an internal search */
   be = select_backend( &dn, 0, 1 );

We are passing true for the last argument - noSubs
And in select_backend(), servers/slapd/backend.c lines 555,556:

           if ( ( SLAP_GLUE_SUBORDINATE( &backends[i] ) ) && noSubs ) {
               continue;
           }

So we see that the code is purposely skipping the subordinate backend.  
Is this correct ? It does not look right to me.  Should we actually be 
passing 0 as the last arg to select_backend() ??

Searching the archives reveals a similar problem: 
http://www.openldap.org/lists/openldap-software/200304/msg00579.html
Was that ever resolved ?

Tom

--
Tom Riddle
HighStreet Networks
www.highstreetnetworks.com