Also, I note that the glued paged response seems to work incorrectly. I made a simple test system, where the root database contains exactly one entry (the suffix) and a back-ldap is glued on top. If I request entries with a page size of 2, searching the suffix return 3 entries; subsequent searches return 2 entries from the proxy. I haven't figured out yet where the issue is.
I figured out how to fix the issue you reported. It is related to the fact that slapd internally assumes that ldctl_oid values are constant strings, so it doesn't duplicate nor free them. However, control OIDs returned by back-ldap (and friends) have been decoded from the wire by the client library, so they are actually malloc'ed. That's why backglue ends up with a dangling pointer.
I'm fixing it by having backglue duplicate (and free) control OIDs consistently. Another option would be to replace those values with constant strings for known control values. This would prevent gluing for unknown proxied controls.
p.