The Root DSE does not depend on SLAPD_CONFIG_DN and friends.
Added a comment for supportedSASLMechanism to root_dse.c

servers/slapd/root_dse.c

@@ -54,6 +54,7 @@ root_dse_info( Connection *conn, Operation *op )
 	/* altServer unsupported */
 	/* supportedExtension: no extensions supported */
 	/* supportedControl: no controls supported */
+	/* supportedSASLMechanism: not yet */
 
 	for ( i=LDAP_VERSION_MIN; i<=LDAP_VERSION_MAX; i++ ) {
 		sprintf(buf,"%d",i);

servers/slapd/search.c

@@ -126,13 +126,14 @@ do_search(
 			goto return_results;
 		}
 #endif
-		if ( strcmp( base, LDAP_ROOT_DSE ) == 0 ) {
-			root_dse_info( conn, op );
-			goto return_results;
-		}
 	}
 #endif /* monitor or config or schema dn */
 
+	if ( strcmp( base, LDAP_ROOT_DSE ) == 0 && scope == LDAP_SCOPE_BASE ) {
+		root_dse_info( conn, op );
+		goto return_results;
+	}
+
 	/*
 	 * We could be serving multiple database backends.  Select the
 	 * appropriate one, or send a referral to our "referral server"