If ldap_result() returns -1 during a search,
ldap_result2err is called with a null ldap message
pointer (held in result). In error.c (OpenLDAP),
ldap_result2err asserts the result is non-null, and nsd
is aborted.
I think this is a bug in OpenLDAP, but it can be easily
worked around in nsldap.c.