diff --git a/dirmngr/ks-engine-ldap.c b/dirmngr/ks-engine-ldap.c
--- a/dirmngr/ks-engine-ldap.c
+++ b/dirmngr/ks-engine-ldap.c
@@ -1530,42 +1530,22 @@
   xfree (modlist);
 }
 
-/* Append two onto the end of one.  Two is not freed, but its pointers
-   are now part of one.  Make sure you don't free them both!
-
-   As long as you don't add anything to ONE, TWO is still valid.
-   After that all bets are off.  */
+/* Append two onto the end of one.  Two remains unchanged, and must be
+   freed as usual.  */
 static void
 modlists_join (LDAPMod ***one, LDAPMod **two)
 {
-  int i, one_count = 0, two_count = 0;
-  LDAPMod **grow;
+  int i;
 
   if (!*two)
     /* two is empty.  Nothing to do.  */
     return;
 
-  if (!*one)
-    /* one is empty.  Just set it equal to *two.  */
+  for (; *two; two++)
     {
-      *one = two;
-      return;
+      for (i = 0; (*two)->mod_values[i]; i++)
+	modlist_add (one, (*two)->mod_type, (*two)->mod_values[i]);
     }
-
-  for (grow = *one; *grow; grow++)
-    one_count ++;
-
-  for (grow = two; *grow; grow++)
-    two_count ++;
-
-  grow = xrealloc (*one, sizeof(LDAPMod *) * (one_count + two_count + 1));
-
-  for (i = 0; i < two_count; i++)
-    grow[one_count + i] = two[i];
-
-  grow[one_count + i] = NULL;
-
-  *one = grow;
 }
 
 /* Given a string, unescape C escapes.  In particular, \xXX.  This
@@ -1993,7 +1973,7 @@
 
       *newline = '\0';
 
-      extract_attributes (&modlist, info);
+      extract_attributes (&addlist, info);
 
       infolen = infolen - ((uintptr_t) newline - (uintptr_t) info + 1);
       info = newline + 1;
@@ -2078,7 +2058,7 @@
   xfree (pgpkeyattr);
 
   modlist_free (modlist);
-  xfree (addlist);
+  modlist_free (addlist);
 
   xfree (data_armored);