https://bugs.openldap.org/show_bug.cgi?id=7596

--- Comment #2 from Ondřej Kuzník ondra@mistotebe.net --- I'm not 100% sure that's the wrong number to return (according to the spec) as we should return "the number of values in that attribute subtracted from the value of pwdGraceAuthNLimit" and the number of values is one lower that you would expect while we're still processing the bind.

Might be worth changing the message in the client to reflect that?