It wasn't immediately obvious to me that the ldap_get_values function does not work with binary data - only strings. If you fetch binary data with ldap_get_values you don't get a warning - just some trash. For binary data you have to use ldap_get_values_len.