diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index d9aa458a55..bbb71b05dc 100644
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -164,12 +164,12 @@ access_allowed(
 		LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 		       "access_allowed: conn %d backend default %s access %s to \"%s\"\n",
 		       conn->c_connid, access2str( access ),
-		       be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn ));
+		       be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val ));
 #else
 		Debug( LDAP_DEBUG_ACL,
 			"=> access_allowed: backend default %s access %s to \"%s\"\n",
 			access2str( access ),
-			be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn );
+			be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val );
 #endif
 		return be->be_dfltaccess >= access;
 
@@ -181,12 +181,12 @@ access_allowed(
 		LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 		       "access_allowed: conn %d global default %s access %s to \"%s\"\n",
 		       conn->c_connid, access2str( access ),
-		       global_default_access >= access ? "granted" : "denied", op->o_dn ));
+		       global_default_access >= access ? "granted" : "denied", op->o_dn.bv_val ));
 #else
 		Debug( LDAP_DEBUG_ACL,
 			"=> access_allowed: global default %s access %s to \"%s\"\n",
 			access2str( access ),
-			global_default_access >= access ? "granted" : "denied", op->o_dn );
+			global_default_access >= access ? "granted" : "denied", op->o_dn.bv_val );
 #endif
 		return global_default_access >= access;
 #endif
@@ -477,7 +477,7 @@ acl_mask(
 	LDAP_LOG(( "acl", LDAP_LEVEL_ARGS,
 		   " to %s by \"%s\", (%s) \n",
 		   val ? "value" : "all values",
-		   op->o_ndn ? op->o_ndn : "",
+		   op->o_ndn.bv_val ? op->o_ndn.bv_val : "",
 		   accessmask2str( *mask, accessmaskbuf ) ));
 #else
 	Debug( LDAP_DEBUG_ACL,
@@ -754,8 +754,8 @@ acl_mask(
 
 		if ( b->a_group_pat.bv_len && op->o_ndn.bv_len ) {
 			char buf[1024];
-			struct berval bv = {1024, buf };
-			struct berval ndn = {0, NULL };
+			struct berval bv = { sizeof(buf) - 1, buf };
+			struct berval ndn = { 0, NULL };
 			int rc;
 
 			/* b->a_group is an unexpanded entry name, expanded it should be an 
diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index 2f86c9c4a0..8ce9c595a5 100644
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -1056,8 +1056,11 @@ accessmask2str( slap_mask_t mask, char *buf )
 	}
 
 	if ( ACL_IS_LEVEL( mask ) ) {
-		*ptr = ')';
-	} 
+		*ptr++ = ')';
+	}
+
+	*ptr = '\0';
+
 	return buf;
 }
 
diff --git a/servers/slapd/back-meta/config.c b/servers/slapd/back-meta/config.c
index 72f557d08f..1d03176f03 100644
--- a/servers/slapd/back-meta/config.c
+++ b/servers/slapd/back-meta/config.c
@@ -143,7 +143,7 @@ meta_back_db_config(
 #endif /* uncomment if uri MUST be a branch of suffix */
 		LDAPURLDesc 	*ludp;
 		char 		*last;
-		struct berval	dn, *pdn = NULL, *ndn = NULL;
+		struct berval	dn;
 		int		rc;
 		
 		if ( argc != 2 ) {
@@ -319,7 +319,7 @@ meta_back_db_config(
 	/* name to use for meta_back_group */
 	} else if ( strcasecmp( argv[ 0 ], "binddn" ) == 0 ) {
 		int 		i = li->ntargets-1;
-		struct berval	dn, *ndn = NULL;
+		struct berval	dn;
 
 		if ( i < 0 ) {
 			fprintf( stderr,
@@ -359,12 +359,12 @@ meta_back_db_config(
 			    fname, lineno );
 			return 1;
 		}
-		li->targets[ i ]->bindpw = ber_bvstrdup( argv[ 1 ] );
+		ber_str2bv( argv[ 1 ], 0L, 1, &li->targets[ i ]->bindpw );
 		
 	/* name to use as pseudo-root dn */
 	} else if ( strcasecmp( argv[ 0 ], "pseudorootdn" ) == 0 ) {
 		int 		i = li->ntargets-1;
-		struct berval	dn, *ndn = NULL;
+		struct berval	dn;
 
 		if ( i < 0 ) {
 			fprintf( stderr,
@@ -404,7 +404,7 @@ meta_back_db_config(
 			    fname, lineno );
 			return 1;
 		}
-		li->targets[ i ]->pseudorootpw = ber_bvstrdup( argv[ 1 ] );
+		ber_str2bv( argv[ 1 ], 0L, 1, &li->targets[ i ]->pseudorootpw );
 	
 	/* dn massaging */
 	} else if ( strcasecmp( argv[ 0 ], "suffixmassage" ) == 0 ) {
diff --git a/servers/slapd/back-meta/data/slapd-ldap-rewrite.conf b/servers/slapd/back-meta/data/slapd-ldap-rewrite.conf
index 23b779a032..ccee741d4e 100644
--- a/servers/slapd/back-meta/data/slapd-ldap-rewrite.conf
+++ b/servers/slapd/back-meta/data/slapd-ldap-rewrite.conf
@@ -30,15 +30,16 @@ access to dn.regex="[^,]+,ou=Groups,dc=[^,]+,o=Foo Bar,c=US" attr=cn
 access to * 
 	by * read
 
-#######################################################################
-# ldbm database definitions
-#######################################################################
-
-include		./slapd-ldbm.conf
-
 #######################################################################
 # ldap database with suffix massage definitions
 #######################################################################
 
 include		./slapd-ldap.conf
 
+#######################################################################
+# ldbm database definitions
+#######################################################################
+
+include		./slapd-ldbm.conf
+
+
diff --git a/servers/slapd/back-meta/init.c b/servers/slapd/back-meta/init.c
index 0598fac873..c5efee02a2 100644
--- a/servers/slapd/back-meta/init.c
+++ b/servers/slapd/back-meta/init.c
@@ -187,17 +187,17 @@ target_free(
 	if ( lt->suffix.bv_val ) {
 		free( lt->suffix.bv_val );
 	}
-	if ( lt->binddn ) {
-		ber_bvfree( lt->binddn );
+	if ( lt->binddn.bv_val ) {
+		free( lt->binddn.bv_val );
 	}
-	if ( lt->bindpw ) {
-		ber_bvfree( lt->bindpw );
+	if ( lt->bindpw.bv_val ) {
+		free( lt->bindpw.bv_val );
 	}
-	if ( lt->pseudorootdn ) {
-		ber_bvfree( lt->pseudorootdn );
+	if ( lt->pseudorootdn.bv_val ) {
+		free( lt->pseudorootdn.bv_val );
 	}
-	if ( lt->pseudorootpw ) {
-		ber_bvfree( lt->pseudorootpw );
+	if ( lt->pseudorootpw.bv_val ) {
+		free( lt->pseudorootpw.bv_val );
 	}
 	if ( lt->rwinfo ) {
 		rewrite_info_delete( lt->rwinfo );