In section 5.1 of RFC 2251, after enumerating the restrictions on BER it says: "These restrictions do not apply to ASN.1 types encapsulated inside of OCTET STRING values, such as attribute values, unless otherwise noted." I think this should also apply control values and extended operation values. If so, I'll call those out as well here for clarification. Jim