diff --git a/CHANGES b/CHANGES
index e3c665ca3a8dfa34731cbf190aef8a60548e0664..2000e7fb605c259f5c21f37b58d4aeb3751a336d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -19,6 +19,7 @@ OpenLDAP 2.4.12 Engineering
 	Fixed slapd-sql fault on NULL fields (ITS#5653)
 	Fixed slapo-constraint string termination (ITS#5609)
 	Fixed slapo-memberof internal operations DN (ITS#5622)
+	Fixed slapo-pcache attrset crash (ITS#5665)
 	Fixed slapo-rwm callback cleanup (ITS#5601)
 	Fixed slapo-rwm attr mapping and merging (ITS#5624)
 	Fixed slapo-rwm objectClass filtering (ITS#5647)
diff --git a/servers/slapd/overlays/pcache.c b/servers/slapd/overlays/pcache.c
index 6c3af99175aeb8c6834b63d111d8634f52d3ab14..d73835662f6ef19f95a83e2907bc633721b65e0c 100644
--- a/servers/slapd/overlays/pcache.c
+++ b/servers/slapd/overlays/pcache.c
@@ -1593,6 +1593,7 @@ struct search_info {
 	Query query;
 	QueryTemplate *qtemp;
 	AttributeName*  save_attrs;	/* original attributes, saved for response */
+	int swap_saved_attrs;
 	int max;
 	int over;
 	int count;
@@ -1984,7 +1985,7 @@ pcache_op_cleanup( Operation *op, SlapReply *rs ) {
 	if ( rs->sr_type == REP_RESULT || 
 		op->o_abandon || rs->sr_err == SLAPD_ABANDON )
 	{
-		if ( si->save_attrs != NULL ) {
+		if ( si->swap_saved_attrs ) {
 			rs->sr_attrs = si->save_attrs;
 			op->ors_attrs = si->save_attrs;
 		}
@@ -2067,7 +2068,7 @@ pcache_response(
 {
 	struct search_info *si = op->o_callback->sc_private;
 
-	if ( si->save_attrs != NULL ) {
+	if ( si->swap_saved_attrs ) {
 		rs->sr_attrs = si->save_attrs;
 		op->ors_attrs = si->save_attrs;
 	}
@@ -2164,7 +2165,7 @@ add_filter_attrs(
 	}
 	BER_BVZERO( &(*new_attrs)[j].an_name );
 
-	return count;
+	return j;
 }
 
 /* NOTE: this is a quick workaround to let pcache minimally interact
@@ -2416,6 +2417,7 @@ pcache_op_search(
 		}
 		si->head = NULL;
 		si->tail = NULL;
+		si->swap_saved_attrs = 1;
 		si->save_attrs = op->ors_attrs;
 
 		op->ors_attrs = qtemp->t_attrs.attrs;