According to RFC 2251 [1], section "4.1.10. Result Message", the matched DN for a bind response should be a zero length string.
I believe that other handlers should also be reviewed according to the following :
For result codes of noSuchObject, aliasProblem, invalidDNSyntax and
aliasDereferencingProblem, the matchedDN field is set to the name of
the lowest entry (object or alias) in the directory that was matched.
If no aliases were dereferenced while attempting to locate the entry,
this will be a truncated form of the name provided, or if aliases
were dereferenced, of the resulting name, as defined in section 12.5
of X.511. The matchedDN field is to be set to a zero length
string with all other result codes.
Jérôme
[1] :
http://www.ietf.org/rfc/rfc2251.txt
Bug
Closed
Trivial
Incorrect matched DN in the bind response (and others depending on the result code)
