I wrote:
And save the connection's BindDN before Compare and restore it after.
Duh, never mind - the frontend does that, I think.
And serialize operations for the entire connection during the Compare, since Bind expects to be the lone active request on the connection while most other operations do not.
Wondering about this one though.