diff --git a/CHANGES b/CHANGES
index e9a0cbdcd4645e2530aa936f7d1070f9a4cfbb43..2a8e3c4d3bd06707dd14388042b8abdf7998f381 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,7 @@ OpenLDAP 2.4.10 Engineering
 	Fixed slapd missing termination of integerFilter keys (ITS#5503)
 	Fixed slapd multiple attrs in URI (ITS#5516)
 	Fixed slapd socket assert (ITS#5489)
+	Fixed slapd sasl_ssf retrieval (ITS#5403)
 	Fixed slapd-bdb/hdb MAXPATHLEN (ITS#5531)
 	Fixed slapd-bdb indexing in single ADD/MOD (ITS#5521)
 	Fixed slapd-ldap entry_get() op-dependent behavior (ITS#5513)
diff --git a/servers/slapd/syncrepl.c b/servers/slapd/syncrepl.c
index d833e969afd5bf54f2e959a5606ea44b0e03008f..0428dfb3ba4b6121a849af12c2145ede0547e3da 100644
--- a/servers/slapd/syncrepl.c
+++ b/servers/slapd/syncrepl.c
@@ -568,7 +568,12 @@ do_syncrep1(
 		op->o_tls_ssf = ldap_pvt_tls_get_strength( ssl );
 	}
 #endif /* HAVE_TLS */
-	ldap_get_option( si->si_ld, LDAP_OPT_X_SASL_SSF, &op->o_sasl_ssf );
+	{
+		ber_len_t ssf; /* ITS#5403, 3864 LDAP_OPT_X_SASL_SSF probably ought
+						  to use sasl_ssf_t but currently uses ber_len_t */
+		ldap_get_option( si->si_ld, LDAP_OPT_X_SASL_SSF, &ssf );
+		op->o_sasl_ssf = ssf;
+	}
 	op->o_ssf = ( op->o_sasl_ssf > op->o_tls_ssf )
 		?  op->o_sasl_ssf : op->o_tls_ssf;