diff --git a/servers/slapd/back-ldap/bind.c b/servers/slapd/back-ldap/bind.c
index 2247405128a9da26f849df66bc59d27be58750ba..fb34a6de598fc0f26fd2904a59e38ea4acb8c0a4 100644
--- a/servers/slapd/back-ldap/bind.c
+++ b/servers/slapd/back-ldap/bind.c
@@ -1800,6 +1800,7 @@ ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_
 			rc = ldap_back_dobind_int( lcp, op, rs, sendok, 0, 0 );
 			if ( rc == 0 && *lcp != NULL ) {
 				/* freeit, because lc_refcnt == 1 */
+				LDAP_BACK_CONN_TAINTED_SET( *lcp );
 				(*lcp)->lc_refcnt = 0;
 				LDAP_BACK_CONN_TAINTED_SET( *lcp );
 				(void)ldap_back_freeconn( li, *lcp, 0 );
diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index c01ec584a51ef30757316ade1c5a0b337d663cc4..baa42e446c57c2e55e07e7b6744432815ab185fb 100644
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -5245,6 +5245,9 @@ int config_entry_release(
 	Entry *e,
 	int rw )
 {
+	if ( !e->e_private ) {
+		entry_free( e );
+	}
 	return LDAP_SUCCESS;
 }
 
diff --git a/servers/slapd/connection.c b/servers/slapd/connection.c
index 6dcd35ee757767031b312c3e2347d3600c17b00a..062734c449a27fcad000d355bca39f6b60e179cf 100644
--- a/servers/slapd/connection.c
+++ b/servers/slapd/connection.c
@@ -1982,7 +1982,7 @@ connection_fake_init(
 	Operation *op,
 	void *ctx )
 {
-	connection_fake_init2( conn, op, ctx, 0 );
+	connection_fake_init2( conn, op, ctx, 1 );
 }
 
 void
diff --git a/servers/slapd/ldapsync.c b/servers/slapd/ldapsync.c
index 1d7bf3b2bf2e34d1347118e1e5ba1309f95b4669..16abf885b0e599ac1a2618f940539a0a44f719dd 100644
--- a/servers/slapd/ldapsync.c
+++ b/servers/slapd/ldapsync.c
@@ -138,12 +138,12 @@ slap_parse_csn_sid( struct berval *csn )
 }
 
 int *
-slap_parse_csn_sids( BerVarray csns, int numcsns )
+slap_parse_csn_sids( BerVarray csns, int numcsns, void *memctx )
 {
 	int i, *ret;
 	char *p, *q;
 
-	ret = ch_malloc( numcsns * sizeof(int) );
+	ret = slap_sl_malloc( numcsns * sizeof(int), memctx );
 	for ( i=0; i<numcsns; i++ ) {
 		ret[i] = slap_parse_csn_sid( &csns[i] );
 	}
@@ -235,7 +235,9 @@ slap_parse_sync_cookie(
 				else
 					stamp.bv_len = end - csn_str;
 				if ( ad ) {
-					value_add_one( &cookie->ctxcsn, &stamp );
+					struct berval bv;
+					ber_dupbv_x( &bv, &stamp, memctx );
+					ber_bvarray_add_x( &cookie->ctxcsn, &bv, memctx );
 					cookie->numcsns++;
 				}
 				if ( cval ) {
@@ -252,7 +254,8 @@ slap_parse_sync_cookie(
 		next++;
 	}
 	if ( cookie->numcsns ) {
-		cookie->sids = slap_parse_csn_sids( cookie->ctxcsn, cookie->numcsns );
+		cookie->sids = slap_parse_csn_sids( cookie->ctxcsn, cookie->numcsns,
+			memctx );
 	}
 	return 0;
 }
diff --git a/servers/slapd/overlays/syncprov.c b/servers/slapd/overlays/syncprov.c
index 7552abb488f4a1316c12c84227bcc6771de583ac..2b4268813ae5ef7e1e735fce8fce1c65b7c22fcb 100644
--- a/servers/slapd/overlays/syncprov.c
+++ b/servers/slapd/overlays/syncprov.c
@@ -1220,9 +1220,11 @@ syncprov_matchops( Operation *op, opcookie *opc, int saveit )
 	ldap_pvt_thread_mutex_unlock( &si->si_ops_mutex );
 
 	if ( op->o_tag != LDAP_REQ_ADD && e ) {
-		op->o_bd->bd_info = (BackendInfo *)on->on_info;
-		be_entry_release_rw( op, e, 0 );
-		op->o_bd->bd_info = (BackendInfo *)on;
+		if ( !SLAP_ISOVERLAY( op->o_bd )) {
+			op->o_bd = &db;
+		}
+		overlay_entry_release_ov( op, e, 0, on );
+		op->o_bd = b0;
 	}
 	if ( freefdn ) {
 		op->o_tmpfree( fc.fdn->bv_val, op->o_tmpmemctx );
@@ -2545,7 +2547,7 @@ syncprov_db_open(
 			ber_bvarray_dup_x( &si->si_ctxcsn, a->a_vals, NULL );
 			for ( i = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ );
 			si->si_numcsns = i;
-			si->si_sids = slap_parse_csn_sids( si->si_ctxcsn, i );
+			si->si_sids = slap_parse_csn_sids( si->si_ctxcsn, i, NULL );
 		}
 		overlay_entry_release_ov( op, e, 0, on );
 		if ( si->si_ctxcsn ) {
diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index fee70b3ccce658927d04dba282cd776aa2516320..eb1d6d795d2b0e02050b21f57c1171b11db53d40 100644
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -1040,7 +1040,7 @@ LDAP_SLAPD_F (void) slap_sync_cookie_free LDAP_P((
 LDAP_SLAPD_F (int) slap_parse_csn_sid LDAP_P((
 				struct berval * ));
 LDAP_SLAPD_F (int *) slap_parse_csn_sids LDAP_P((
-				BerVarray, int ));
+				BerVarray, int, void *memctx ));
 LDAP_SLAPD_F (int) slap_parse_sync_cookie LDAP_P((
 				struct sync_cookie *, void *memctx ));
 LDAP_SLAPD_F (int) slap_init_sync_cookie_ctxcsn LDAP_P((
diff --git a/servers/slapd/syncrepl.c b/servers/slapd/syncrepl.c
index b5fef03d485fdadedcfbeeb71f96259277f96731..c297650da2b359b674029c58b8360ad131f86c93 100644
--- a/servers/slapd/syncrepl.c
+++ b/servers/slapd/syncrepl.c
@@ -499,7 +499,7 @@ do_syncrep1(
 					si->si_cookieState->cs_vals = csn;
 					for (i=0; !BER_BVISNULL( &csn[i] ); i++);
 					si->si_cookieState->cs_num = i;
-					si->si_cookieState->cs_sids = slap_parse_csn_sids( csn, i );
+					si->si_cookieState->cs_sids = slap_parse_csn_sids( csn, i, NULL );
 				}
 			}
 			if ( si->si_cookieState->cs_num ) {
@@ -567,7 +567,7 @@ do_syncrep1(
 				si->si_cookieState->cs_num = num;
 				si->si_cookieState->cs_vals = a.a_vals;
 				si->si_cookieState->cs_sids = slap_parse_csn_sids( a.a_vals,
-					num );
+					num, NULL );
 				si->si_cookieState->cs_age++;
 			} else {
 				ber_bvarray_free( a.a_vals );
@@ -852,11 +852,11 @@ do_syncrep2(
 					}
 					ber_scanf( ber, /*"{"*/ "}" );
 				}
-				if ( !syncCookie_req.ctxcsn ) {
+				if ( !syncCookie.ctxcsn ) {
+					match = 1;
+				} else if ( !syncCookie_req.ctxcsn ) {
 					match = -1;
 					m = 0;
-				} else if ( !syncCookie.ctxcsn ) {
-					match = 1;
 				} else {
 					match = compare_csns( &syncCookie_req, &syncCookie, &m );
 				}
@@ -999,11 +999,11 @@ do_syncrep2(
 						continue;
 					}
 
-					if ( !syncCookie_req.ctxcsn ) {
+					if ( !syncCookie.ctxcsn ) {
+						match = 1;
+					} else if ( !syncCookie_req.ctxcsn ) {
 						match = -1;
 						m = 0;
-					} else if ( !syncCookie.ctxcsn ) {
-						match = 1;
 					} else {
 						match = compare_csns( &syncCookie_req, &syncCookie, &m );
 					}
@@ -2608,7 +2608,7 @@ syncrepl_updateCookie(
 			value_add( &si->si_cookieState->cs_vals, syncCookie->ctxcsn );
 			free( si->si_cookieState->cs_sids );
 			si->si_cookieState->cs_sids = slap_parse_csn_sids(
-				si->si_cookieState->cs_vals, si->si_cookieState->cs_num );
+				si->si_cookieState->cs_vals, si->si_cookieState->cs_num, NULL );
 		}
 
 		si->si_cookieState->cs_age++;