Upon further investigation of the issue, I discovered it's not a bug in nslcd at all, and it's using the appropriate exop.
This bug is instead in slapd, which occurs reliably when CRYPT is the password format used. Apologies for wasting your time, Elizabeth
