rc = bdb_filter_candidates( be, f, save, tmp );
 
                if ( rc != 0 ) {
-                       /* Error: treat as undefined */
-                       continue;
+                       if ( ftype == LDAP_FILTER_AND ) {
+                               rc = 0;
+                               continue;
+                       }
+                       break;
                }
                
                if ( ftype == LDAP_FILTER_AND ) {
                        BDB_IDL_ALL( bdb, save );
                }
        }
+
 #if !defined(LDAP_PVT_THREAD_STACK_SIZE) || (LDAP_PVT_THREAD_STACK_SIZE == 0)
        free(save);
 #endif
 
-       Debug( LDAP_DEBUG_FILTER,
-               "<= bdb_list_candidates: id=%ld first=%ld last=%ld\n",
-               (long) ids[0],
-               (long) BDB_IDL_FIRST(ids),
-               (long) BDB_IDL_LAST(ids) );
-       return 0;
+       if( rc ) {
+               Debug( LDAP_DEBUG_FILTER,
+                       "<= bdb_list_candidates: id=%ld first=%ld last=%ld\n",
+                       (long) ids[0],
+                       (long) BDB_IDL_FIRST(ids),
+                       (long) BDB_IDL_LAST(ids) );
+
+       } else {
+               Debug( LDAP_DEBUG_FILTER,
+                       "<= bdb_list_candidates: undefined rc=%d\n",
+                       rc, 0, 0 );
+       }
+
+       return rc;
 }
 
 static int
 
        ber_dupbv( &realbase, &e->e_nname );
 
        /* start cursor at base entry's id 
-        * FIXME: hack to make "" base work */
+        * FIXME: hack to make "" base work
+        * FIXME: moddn needs to assign new ID for this to work
+        */
        cursor = e->e_id == NOID ? 1 : e->e_id;
 
        if ( e != &slap_entry_root ) {
 
        rc = bdb_filter_candidates( be, &f, ids, tmp );
 
-       Debug(LDAP_DEBUG_TRACE,
-               "bdb_search_candidates: id=%ld first=%ld last=%ld\n",
-               (long) ids[0],
-               (long) BDB_IDL_FIRST(ids),
-               (long) BDB_IDL_LAST(ids) );
+       if( rc ) {
+               Debug(LDAP_DEBUG_TRACE,
+                       "bdb_search_candidates: failed (rc=%d)\n",
+                       rc, NULL, NULL );
+
+       } else {
+               Debug(LDAP_DEBUG_TRACE,
+                       "bdb_search_candidates: id=%ld first=%ld last=%ld\n",
+                       (long) ids[0],
+                       (long) BDB_IDL_FIRST(ids),
+                       (long) BDB_IDL_LAST(ids) );
+       }
 
        return rc;
 }