That's interesting. What I'm really doing, instead of the second elog statement, is this:
$ret = $ldap->modify( $dn,
replace => {
unicodePwd => $mspass
} );
This does work for strings that don't contain consecutive zeroes. I'm not really passing the string to PostgreSQL, but to Net::LDAP, but it must hit PostgreSQL anyway? Active Directory requires this encoding, so I'm not sure what to do here.