It ought to work to have nss modules that have DT_NEEDED requirements on other libraries, because the static libdl will load those too. It's just that a loaded module that calls dlopen will get a dynamic libdl instead of (and in addition to) the static libdl.