diff --git a/servers/slapd/overlays/rwm.c b/servers/slapd/overlays/rwm.c
index 19c18add90..ebe9815438 100644
--- a/servers/slapd/overlays/rwm.c
+++ b/servers/slapd/overlays/rwm.c
@@ -368,7 +368,10 @@ rwm_op_compare( Operation *op, SlapReply *rs )
 			}
 
 			if ( mapped_vals[ 0 ].bv_val != op->orc_ava->aa_value.bv_val ) {
-				ber_bvreplace_x( &op->orc_ava->aa_value, &mapped_vals[0],
+				/* NOTE: if we get here, rwm_dnattr_rewrite()
+				 * already freed the old value, so now 
+				 * it's invalid */
+				ber_dupbv_x( &op->orc_ava->aa_value, &mapped_vals[0],
 						op->o_tmpmemctx );
 				ber_memfree_x( mapped_vals[ 0 ].bv_val, NULL );
 			}