The places where nss_ldap uses sync APIs are mainly confined to the netgroups functionality, but a bigger problem is that it blocks in SSL_connect() when starting up ldaps (LDAP over SSL) connections. But that's not quite the same problem. This is one of those situations where having nss_ldap do all of its work out-of-process would have made the problem case far simpler to work around.