diff -up openldap-2.3.43/libraries/libldap/os-ip.c.orig openldap-2.3.43/libraries/libldap/os-ip.c
--- openldap-2.3.43/libraries/libldap/os-ip.c.orig	2008-05-19 19:28:54.000000000 -0400
+++ openldap-2.3.43/libraries/libldap/os-ip.c	2009-07-29 17:01:32.000000000 -0400
@@ -738,6 +738,9 @@ ldap_mark_select_read( LDAP *ld, Sockbuf
 
 	sip = (struct selectinfo *)ld->ld_selectinfo;
 
+	if (ber_sockbuf_ctrl( sb, LBER_SB_OPT_DATA_READY, NULL ))
+		return;
+
 	ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_FD, &sd );
 
 #ifdef HAVE_POLL
diff -up openldap-2.3.43/libraries/libldap/result.c.orig openldap-2.3.43/libraries/libldap/result.c
--- openldap-2.3.43/libraries/libldap/result.c.orig	2009-07-29 17:00:42.000000000 -0400
+++ openldap-2.3.43/libraries/libldap/result.c	2009-07-29 18:10:35.000000000 -0400
@@ -73,7 +73,7 @@ static int ldap_mark_abandoned LDAP_P(( 
 static int wait4msg LDAP_P(( LDAP *ld, ber_int_t msgid, int all, struct timeval *timeout,
 	LDAPMessage **result ));
 static ber_tag_t try_read1msg LDAP_P(( LDAP *ld, ber_int_t msgid,
-	int all, LDAPConn **lc, LDAPMessage **result ));
+	int all, LDAPConn *lc, LDAPMessage **result ));
 static ber_tag_t build_result_ber LDAP_P(( LDAP *ld, BerElement **bp, LDAPRequest *lr ));
 static void merge_error_info LDAP_P(( LDAP *ld, LDAPRequest *parentr, LDAPRequest *lr ));
 static LDAPMessage * chkResponseList LDAP_P(( LDAP *ld, int msgid, int all));
@@ -118,15 +118,9 @@ ldap_result(
 #ifdef LDAP_R_COMPILE
 	ldap_pvt_thread_mutex_lock( &ld->ld_res_mutex );
 #endif
-	lm = chkResponseList(ld, msgid, all);
 
-	if ( lm == NULL ) {
-		rc = wait4msg( ld, msgid, all, timeout, result );
-	} else {
-		*result = lm;
-		ld->ld_errno = LDAP_SUCCESS;
-		rc = lm->lm_msgtype;
-	}
+	rc = wait4msg( ld, msgid, all, timeout, result );
+
 #ifdef LDAP_R_COMPILE
 	ldap_pvt_thread_mutex_unlock( &ld->ld_res_mutex );
 #endif
@@ -233,7 +227,7 @@ wait4msg(
 			*tvp;
 	time_t		start_time = 0;
 	time_t		tmp_time;
-	LDAPConn	*lc;
+	LDAPConn	*lc, *nextlc;
 
 	assert( ld != NULL );
 	assert( result != NULL );
@@ -280,13 +274,6 @@ wait4msg(
 			for ( lc = ld->ld_conns; lc != NULL; lc = lc->lconn_next ) {
 				if ( ber_sockbuf_ctrl( lc->lconn_sb,
 						LBER_SB_OPT_DATA_READY, NULL ) ) {
-#ifdef LDAP_R_COMPILE
-					ldap_pvt_thread_mutex_unlock( &ld->ld_conn_mutex );
-#endif
-					rc = try_read1msg( ld, msgid, all, &lc, result );
-#ifdef LDAP_R_COMPILE
-					ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
-#endif
 					lc_ready = 1;
 					break;
 				}
@@ -319,7 +306,11 @@ wait4msg(
 				if ( rc == -1 ) {
 					rc = LDAP_MSG_X_KEEP_LOOKING;	/* select interrupted: loop */
 				} else {
-					rc = LDAP_MSG_X_KEEP_LOOKING;
+					lc_ready = 1;
+				}
+			}
+			if ( lc_ready ) {
+				rc = LDAP_MSG_X_KEEP_LOOKING;
 #ifdef LDAP_R_COMPILE
 					ldap_pvt_thread_mutex_lock( &ld->ld_req_mutex );
 #endif
@@ -335,38 +326,43 @@ wait4msg(
 					ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
 #endif
 					for ( lc = ld->ld_conns;
-						rc == LDAP_MSG_X_KEEP_LOOKING && lc != NULL; )
+						rc == LDAP_MSG_X_KEEP_LOOKING && lc != NULL;
+						lc = nextlc )
 					{
 						if ( lc->lconn_status == LDAP_CONNST_CONNECTED &&
 							ldap_is_read_ready( ld, lc->lconn_sb ))
 						{
+							/* Don't let it get freed out from under us */
+							++lc->lconn_refcnt;
 #ifdef LDAP_R_COMPILE
 							ldap_pvt_thread_mutex_unlock( &ld->ld_conn_mutex );
 #endif
-							rc = try_read1msg( ld, msgid, all, &lc, result );
+							rc = try_read1msg( ld, msgid, all, lc, result );
+							nextlc = lc->lconn_next;
+
+							/* Only take locks if we're really freeing */
+							if ( lc->lconn_refcnt <= 1 ) {
 #ifdef LDAP_R_COMPILE
-							ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
+								ldap_pvt_thread_mutex_lock( &ld->ld_req_mutex );
 #endif
-							if ( lc == NULL ) {
-								/* if lc gets free()'d,
-								 * there's no guarantee
-								 * lc->lconn_next is still
-								 * sane; better restart
-								 * (ITS#4405) */
-								lc = ld->ld_conns;
-
-								/* don't get to next conn! */
-								break;
+								ldap_free_connection( ld, lc, 0, 1 );
+#ifdef LDAP_R_COMPILE
+								ldap_pvt_thread_mutex_unlock( &ld->ld_req_mutex );
+#endif
+							} else {
+								--lc->lconn_refcnt;
 							}
+#ifdef LDAP_R_COMPILE
+							ldap_pvt_thread_mutex_lock( &ld->ld_conn_mutex );
+#endif
+						} else {
+							/* next conn */
+							nextlc = lc->lconn_next;
 						}
-
-						/* next conn */
-						lc = lc->lconn_next;
 					}
 #ifdef LDAP_R_COMPILE
 					ldap_pvt_thread_mutex_unlock( &ld->ld_conn_mutex );
 #endif
-				}
 			}
 		}
 
@@ -380,7 +376,6 @@ wait4msg(
 			if ( tv0.tv_sec <= delta_time ) {
 				rc = 0;	/* timed out */
 				ld->ld_errno = LDAP_TIMEOUT;
-				break;
 			}
 			tv0.tv_sec -= delta_time;
 			tv.tv_sec = tv0.tv_sec;
@@ -400,7 +395,7 @@ try_read1msg(
 	LDAP *ld,
 	ber_int_t msgid,
 	int all,
-	LDAPConn **lcp,
+	LDAPConn *lc,
 	LDAPMessage **result )
 {
 	BerElement	*ber;
@@ -410,7 +405,6 @@ try_read1msg(
 	ber_len_t	len;
 	int		foundit = 0;
 	LDAPRequest	*lr, *tmplr;
-	LDAPConn	*lc;
 	BerElement	tmpber;
 	int		rc, refer_cnt, hadref, simple_request, err;
 	ber_int_t	lderr;
@@ -431,14 +425,11 @@ try_read1msg(
 	}	v3ref;
 
 	assert( ld != NULL );
-	assert( lcp != NULL );
-	assert( *lcp != NULL );
+	assert( lc != NULL );
 	
 	Debug( LDAP_DEBUG_TRACE, "read1msg: ld %p msgid %d all %d\n",
 		(void *)ld, msgid, all );
 
-	lc = *lcp;
-
 retry:
 	if ( lc->lconn_ber == NULL ) {
 		lc->lconn_ber = ldap_alloc_ber_with_options(ld);
@@ -839,14 +830,8 @@ lr->lr_res_matched ? lr->lr_res_matched 
 			}
 
 			if ( lc != NULL ) {
-#ifdef LDAP_R_COMPILE
-				ldap_pvt_thread_mutex_lock( &ld->ld_req_mutex );
-#endif
-				ldap_free_connection( ld, lc, 0, 1 );
-#ifdef LDAP_R_COMPILE
-				ldap_pvt_thread_mutex_unlock( &ld->ld_req_mutex );
-#endif
-				lc = *lcp = NULL;
+				--lc->lconn_refcnt;
+				lc = NULL;
 			}
 		}
 	}