diff -urN ../exim-4.94.2.orig/doc/ChangeLog ./doc/ChangeLog
--- ../exim-4.94.2.orig/doc/ChangeLog	2021-04-30 15:08:21.000000000 +0300
+++ ./doc/ChangeLog	2021-08-21 12:50:34.331375000 +0300
@@ -220,6 +220,22 @@
 QS/04 Always die if requested from internal logging, even is logging is
       disabled.
 
+JH/52 Fix ${ip6norm:} operator.  Previously, any trailing line text was dropped,
+      making it unusable in complex expressions.
+
+JH/53 Bug 2743: fix immediate-delivery via named queue.  Previously this would
+      fail with a taint-check on the spoolfile name, and leave the message
+      queued.
+
+JH/57 Fix control=fakreject for a custom message containing tainted data.
+      Previously this resulted in a log complaint, due to a re-expansion present
+      since fakereject was originally introduced.
+
+JH/59 DKIM: Fix small-message verification under TLS with chunking. If a
+      pipelined SMTP command followed the BDAT LAST then it would be
+      incorrrectly treated as part of the message body, causing a verification
+      fail.
+
 
 Exim version 4.94
 -----------------
diff -urN ../exim-4.94.2.orig/src/acl.c ./src/acl.c
--- ../exim-4.94.2.orig/src/acl.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/acl.c	2021-08-21 12:50:34.352371000 +0300
@@ -3137,7 +3137,9 @@
 	    {
 	    const uschar *pp = p + 1;
 	    while (*pp) pp++;
-	    fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
+	    /* The entire control= line was expanded at top so no need to expand
+	    the part after the / */
+	    fake_response_text = string_copyn(p+1, pp-p-1);
 	    p = pp;
 	    }
 	   else /* Explicitly reset to default string */
diff -urN ../exim-4.94.2.orig/src/dkim.c ./src/dkim.c
--- ../exim-4.94.2.orig/src/dkim.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/dkim.c	2021-08-21 12:50:34.363672000 +0300
@@ -127,8 +127,9 @@
 dkim_collect_input = dkim_verify_ctx ? DKIM_MAX_SIGNATURES : 0;
 dkim_collect_error = NULL;
 
-/* Start feed up with any cached data */
-receive_get_cache();
+/* Start feed up with any cached data, but limited to message data */
+receive_get_cache(chunking_state == CHUNKING_LAST
+		  ? chunking_data_left : GETC_BUFFER_UNLIMITED);
 
 store_pool = dkim_verify_oldpool;
 }
diff -urN ../exim-4.94.2.orig/src/exim.c ./src/exim.c
--- ../exim-4.94.2.orig/src/exim.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/exim.c	2021-08-21 12:50:34.366968000 +0300
@@ -2789,9 +2789,11 @@
 		  else badarg = TRUE;
 		  break;
 
-    /* -MCG: set the queue name, to a non-default value */
+    /* -MCG: set the queue name, to a non-default value. Arguably, anything
+       from the commandline should be tainted - but we will need an untainted
+       value for the spoolfile when doing a -odi delivery process. */
 
-	case 'G': if (++i < argc) queue_name = string_copy_taint(exim_str_fail_toolong(argv[i], EXIM_DRIVERNAME_MAX, "-MCG"), TRUE);
+	case 'G': if (++i < argc) queue_name = string_copy_taint(exim_str_fail_toolong(argv[i], EXIM_DRIVERNAME_MAX, "-MCG"), FALSE);
 		  else badarg = TRUE;
 		  break;
 
diff -urN ../exim-4.94.2.orig/src/functions.h ./src/functions.h
--- ../exim-4.94.2.orig/src/functions.h	2021-04-30 15:08:21.000000000 +0300
+++ ./src/functions.h	2021-08-21 12:50:34.373507000 +0300
@@ -64,7 +64,7 @@
 extern void    tls_free_cert(void **);
 extern int     tls_getc(unsigned);
 extern uschar *tls_getbuf(unsigned *);
-extern void    tls_get_cache(void);
+extern void    tls_get_cache(unsigned);
 extern BOOL    tls_import_cert(const uschar *, void **);
 extern int     tls_read(void *, uschar *, size_t);
 extern int     tls_server_start(const uschar *, uschar **);
@@ -481,7 +481,7 @@
 extern BOOL    smtp_get_port(uschar *, address_item *, int *, uschar *);
 extern int     smtp_getc(unsigned);
 extern uschar *smtp_getbuf(unsigned *);
-extern void    smtp_get_cache(void);
+extern void    smtp_get_cache(unsigned);
 extern int     smtp_handle_acl_fail(int, int, uschar *, uschar *);
 extern void    smtp_log_no_mail(void);
 extern void    smtp_message_code(uschar **, int *, uschar **, uschar **, BOOL);
diff -urN ../exim-4.94.2.orig/src/globals.c ./src/globals.c
--- ../exim-4.94.2.orig/src/globals.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/globals.c	2021-08-21 12:50:34.373866000 +0300
@@ -168,7 +168,7 @@
 int (*lwr_receive_ungetc)(int) = stdin_ungetc;
 int (*receive_getc)(unsigned)  = stdin_getc;
 uschar * (*receive_getbuf)(unsigned *)  = NULL;
-void (*receive_get_cache)(void)= NULL;
+void (*receive_get_cache)(unsigned)     = NULL;
 int (*receive_ungetc)(int)     = stdin_ungetc;
 int (*receive_feof)(void)      = stdin_feof;
 int (*receive_ferror)(void)    = stdin_ferror;
diff -urN ../exim-4.94.2.orig/src/globals.h ./src/globals.h
--- ../exim-4.94.2.orig/src/globals.h	2021-04-30 15:08:21.000000000 +0300
+++ ./src/globals.h	2021-08-21 12:50:34.374368000 +0300
@@ -156,7 +156,7 @@
 extern int (*lwr_receive_ungetc)(int);
 extern int (*receive_getc)(unsigned);
 extern uschar * (*receive_getbuf)(unsigned *);
-extern void (*receive_get_cache)(void);
+extern void (*receive_get_cache)(unsigned);
 extern int (*receive_ungetc)(int);
 extern int (*receive_feof)(void);
 extern int (*receive_ferror)(void);
diff -urN ../exim-4.94.2.orig/src/host.c ./src/host.c
--- ../exim-4.94.2.orig/src/host.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/host.c	2021-08-21 12:50:34.375845000 +0300
@@ -1197,9 +1197,9 @@
   c++;
   }
 
-c[-1] = '\0';	/* drop trailing colon */
+*--c = '\0';	/* drop trailing colon */
 
-/* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, d, d + 2*(k+1)); */
+/* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, buffer, buffer + 2*(k+1)); */
 if (k >= 0)
   {			/* collapse */
   c = d + 2*(k+1);
@@ -1581,7 +1581,7 @@
 
   if (hosts->h_aliases)
     {
-    int count = 1;
+    int count = 1;  /* need 1 more for terminating NULL */
     uschar **ptr;
 
     for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++) count++;
@@ -1690,7 +1690,7 @@
       {
       uschar **aptr = NULL;
       int ssize = 264;
-      int count = 0;
+      int count = 1;  /* need 1 more for terminating NULL */
       int old_pool = store_pool;
 
       sender_host_dnssec = dns_is_secure(dnsa);
diff -urN ../exim-4.94.2.orig/src/smtp_in.c ./src/smtp_in.c
--- ../exim-4.94.2.orig/src/smtp_in.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/smtp_in.c	2021-08-21 12:50:34.394994000 +0300
@@ -583,10 +583,12 @@
 }
 
 void
-smtp_get_cache(void)
+smtp_get_cache(unsigned lim)
 {
 #ifndef DISABLE_DKIM
 int n = smtp_inend - smtp_inptr;
+if (n > lim)
+  n = lim;
 if (n > 0)
   dkim_exim_verify_feed(smtp_inptr, n);
 #endif
@@ -661,7 +663,9 @@
   if (chunking_state == CHUNKING_LAST)
     {
 #ifndef DISABLE_DKIM
+    dkim_collect_input = dkim_save;
     dkim_exim_verify_feed(NULL, 0);	/* notify EOD */
+    dkim_collect_input = 0;
 #endif
     return EOD;
     }
diff -urN ../exim-4.94.2.orig/src/tls-gnu.c ./src/tls-gnu.c
--- ../exim-4.94.2.orig/src/tls-gnu.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/tls-gnu.c	2021-08-21 12:50:34.398909000 +0300
@@ -3267,11 +3267,13 @@
 
 
 void
-tls_get_cache()
+tls_get_cache(unsigned lim)
 {
 #ifndef DISABLE_DKIM
 exim_gnutls_state_st * state = &state_server;
 int n = state->xfer_buffer_hwm - state->xfer_buffer_lwm;
+if (n > lim)
+  n = lim;
 if (n > 0)
   dkim_exim_verify_feed(state->xfer_buffer+state->xfer_buffer_lwm, n);
 #endif
diff -urN ../exim-4.94.2.orig/src/tls-openssl.c ./src/tls-openssl.c
--- ../exim-4.94.2.orig/src/tls-openssl.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/tls-openssl.c	2021-08-21 12:50:34.399951000 +0300
@@ -3566,10 +3566,12 @@
 
 
 void
-tls_get_cache()
+tls_get_cache(unsigned lim)
 {
 #ifndef DISABLE_DKIM
 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
+if (n > lim)
+  n = lim;
 if (n > 0)
   dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
 #endif
diff -urN ../exim-4.94.2.orig/src/transports/appendfile.c ./src/transports/appendfile.c
--- ../exim-4.94.2.orig/src/transports/appendfile.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/transports/appendfile.c	2021-08-21 12:50:34.402148000 +0300
@@ -476,7 +476,7 @@
     value = create_inhome;
   else
     log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
-      "invalid value given for \"file_create\" for the %s transport: %s",
+      "invalid value given for \"create_file\" for the %s transport: %s",
         tblock->name, ob->create_file_string);
   ob->create_file = value;
   }
diff -urN ../exim-4.94.2.orig/src/transports/smtp.c ./src/transports/smtp.c
--- ../exim-4.94.2.orig/src/transports/smtp.c	2021-04-30 15:08:21.000000000 +0300
+++ ./src/transports/smtp.c	2021-08-21 12:50:34.405076000 +0300
@@ -2015,7 +2015,7 @@
       {
       case OK:		sx->conn_args.dane = TRUE;
 			ob->tls_tempfail_tryclear = FALSE;	/* force TLS */
-			ob->tls_sni = sx->first_addr->domain;	/* force SNI */
+                        ob->tls_sni = sx->conn_args.host->name; /* force SNI */
 			break;
       case FAIL_FORCED:	break;
       default:		set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,
@@ -2097,7 +2097,7 @@
 	  {
 	  case OK:		sx->conn_args.dane = TRUE;
 				ob->tls_tempfail_tryclear = FALSE;	/* force TLS */
-				ob->tls_sni = sx->first_addr->domain;	/* force SNI */
+				ob->tls_sni = sx->conn_args.host->name; /* force SNI */
 				break;
 	  case FAIL_FORCED:	break;
 	  default:		set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,
diff -urN ../exim-4.94.2.orig/src/version.h ./src/version.h
--- ../exim-4.94.2.orig/src/version.h	2021-04-30 15:11:38.000000000 +0300
+++ ./src/version.h	2021-08-21 12:50:35.064585000 +0300
@@ -1,5 +1,5 @@
 /* automatically generated file - see ../scripts/reversion */
-#define EXIM_RELEASE_VERSION "4.94.2"
+#define EXIM_RELEASE_VERSION "4.94.2-11-44a62f586"
 #ifdef EXIM_VARIANT_VERSION
 #define EXIM_VERSION_STR EXIM_RELEASE_VERSION "-" EXIM_VARIANT_VERSION
 #else
diff -urN ../exim-4.94.2.orig/src/version.sh ./src/version.sh
--- ../exim-4.94.2.orig/src/version.sh	2021-04-30 15:11:38.000000000 +0300
+++ ./src/version.sh	2021-08-21 12:50:35.064151000 +0300
@@ -1,3 +1,3 @@
 # automatically generated file - see ../scripts/reversion
-EXIM_RELEASE_VERSION="4.94.2"
+EXIM_RELEASE_VERSION="4.94.2-11-44a62f586"
 EXIM_COMPILE_NUMBER="1"