I remembered people complaining how glibc ignores NSS errors with getpwent(), so I thought I'd see how easy it is to use NSS directly. Unless I misunderstood something, this should work:

http://hg.dovecot.org/dovecot/rev/c9b49ed99d28

Tested only with "files" backend. Also it won't work with Solaris, it seems to have completely different NSS modules. Don't know about BSDs.

Can someone test how it handles LDAP/NIS failures (or if it even works with them)?