ldap_new_connection(), if ( connect ) and lconn_server->lud_exts contain the tls ext, first unlocks and then re-locks ld_req_mutex and ld_res_mutex. As far as I understand, while the former is actually held by the caller(s) of ldap_new_connection(), the latter is not.
I forgot to mention that the pattern seems to repeat throughout the function, also when rebinding or binding anonymously while chasing referrals. I definitely might be missing something.
p.