The code now copies to a sasl_ssf_t wherever necessary. The ldap_set_option() argument remains a (ber_len_t *) since that was probably the expected behavior. Of course, since we officially dropped support for Cyrus 1.x in 2003, it doesn't seem fair to consider that case here. Could go either way here. Thus far it hasn't been an issue on any known platform, 32 or 64 bit, so which way we decide to go doesn't much matter to me.