It returns whatever returned by sasl_getprop(); it should be a pointer to a zero-terminated string within the SASL context (you don't have to free it, but it may be invalidated when the context is destroyed).
It seems "you don't have to free it" was the clue! Well, it rather means you must not free it.
I'm documenting options, and noticed that all other values are duplicated rather than returned as they are. Would you mind reverting the behavior of this option? I mean: return a LDAP_MALLOC'ed string instead of a pointer to a string within the SASL handle?
p.