The "com.sun.jndi.ldap.sasl.SaslInputStream" class has this code:

    public int read() throws IOException {
        byte[] inBuf = new byte[1];
        int count = read(inBuf, 0, 1);
        if (count > 0) {
            return inBuf[0];
        } else {
            return -1;
        }
    }

SaslInputStream.read() should return a value in the range from 0 to 255 per the spec of InputStream.read() but it returns the signed byte from the inBuf as is.