In user.php bind isbut why loadarray and not loadstring it is a string inside. If i replace with loadString everyting is fine.
array params is always stored in _params.
So the LDAP plugin is probably not acting acoordingly on usersave to handle the params and onuserbeforesave is just too late.

Hello,
and do you know confirmed that the CB profile save works fine with other third party params?
Because to me it looks like UserTable::load is called and loads the row (including the params).
Then UserTable::bindSafely is called, which calls $row->bind( $postCopy ); which executes the piece above, while in params is still the raw string from the db (which should not be there). So I am not sure if extensions have a chance to act between those 2 calls.
However when UserTable::store is finally called, _mapUsers(); loads the cms user and the params again and put them correctly in _params, but it is fine there anyways because the bindSafely has already been called. And the actual cms store cares only for _params (which is corrupted if the above code gets executed with the raw string in params). So it looks like params should not be loaded at all in UserTable::load or be erased there at least it works in my case.

Hello and thanks again.
But the thing is onUserBeforeSave is called too late.
$this->_cmsUser->save(); in UserTable::store ends up calling it.
But bindSafely is called before and has already corrupted it at this point.
I agree params should always be raw string and is, that is why $this->_params->loadArray($array); (called inside bindSafely) is corrupting it. It puts into _params a [0] index with the whole string, which is where the growing wrong string is coming from. Akward that joomla uses loadarray there if it is always a string. Do you know any other plugin that uses params on users so I can check why it is working in other cases