Slightly more esoteric than usual; I'm posting this for my benefit as much as anyone else's!
Error performing SASL authentication step: SASL(-7): invalid parameter supplied: Parameter Error in /System/Volumes/Data/SWE/macOS/BuildRoots/533514bb11/Library/Caches/com.apple.xbs/Sources/passwordserver_saslplugins/passwordserver_saslplugins-194/plain_clienttoken.c near line 195
I eventually figured out (from reading Jakub Kadlčík's clear post) that you need to tell mbsync which authentication method it should use - for some reason it doesn't correctly autodetect. I added in the
Now it's able to log in fine.