Valid heap-buffer-overflow in slapidnnormalizeext() -> sortrdnavs() -> rdnavswap() (ldap/servers/slapd/dn.c). Triggered when a DN contains a legacy-quoted value encoding a multivalued nested RDN. On closing quote, nested attribute-value tracking is not finalized; a subsequent separator can leave stale pointers that produce overlapping berval entries. In-place sorting then writes past the heap allocation in rdnavswap(). Reachable pre-auth via any LDAP operation whose DN is normalized (search base DN confirmed). Reproduced on RHEL 9.8 (389-ds-base-2.8.0-7.el98) with reporter PoC. Production behavior (no ASAN/MALLOCCHECK): malformed DN often returns err=34 (Invalid DN syntax); server continues. With MALLOCCHECK=3: general protection fault in libc, ns-slapd terminates.