diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
index cc401aefaa..b7f32c3570 100644
--- a/servers/slapd/overlays/ppolicy.c
+++ b/servers/slapd/overlays/ppolicy.c
@@ -2121,8 +2121,11 @@ ppolicy_db_init(
 
 	on->on_bi.bi_private = ch_calloc( sizeof(pp_info), 1 );
 
-	if ( dtblsize && !pwcons )
-		pwcons = ch_calloc(sizeof(pw_conn), dtblsize );
+	if ( dtblsize && !pwcons ) {
+		/* accommodate for c_conn_idx == -1 */
+		pwcons = ch_calloc( sizeof(pw_conn), dtblsize + 1 );
+		pwcons++;
+	}
 
 	return 0;
 }
@@ -2149,6 +2152,7 @@ ppolicy_close(
 	/* Perhaps backover should provide bi_destroy hooks... */
 	ov_count--;
 	if ( ov_count <=0 && pwcons ) {
+		pwcons--;
 		free( pwcons );
 		pwcons = NULL;
 	}