BerElement argument per latest IETF ldapext draft c api spec. That is, caller is solely responsible for freeing the BerElement allocated and returned by ldap_first_attribute. Update man pages accordingly. Update applications accordingly.