Other bugs:

* be->be_chk_referrals:

back-bdb and back-ldif can send errors from be->be_chk_referrals. As far as I can tell that is wrong:

It should return an LDAP result code, but only send it if it is LDAP_REFERRAL. backend_check_referrals() will send other errors, and success means it'll proceed to the be->be_<operation>() call.

* be->be_fetch() (bi->bi_entry_get_rw()):

The LDAP result code matters to at least aci.c:dynacl_aci_mask() and frontendDB->be_compare() (compare.c:fe_op_compare()). These use it via backend_attribute(), using frontendDB->be_attribute() (fe_acl_attribute()), using backend.c:be_entry_get_rw().

It can return just a boolean in back-null, back-ldif, back-relay and back-config.

back-null usually pretends the entries are present, so maybe it should do "return oc ? LDAP_NO_SUCH_ATTRIBUTE : LDAP_BUSY;".

* Internal slapd errors.

back-ldap:ldap_back_entry_get() can return LDAP_NO_MEMORY. Maybe that's OK and instead send_ldap_response() should change negative negative result codes to LDAP_OTHER?