VERP oddness--qmail bug?

Playing with the new qconfirm features, I came across the following oddness.

In my virtualdomains file, I have:

test.palomine.net:testguy

In testguy's home directory, I invoke qconfirm in .qmail-jsmith.

Then I send mail from my account (on the same server that hosts
test.palomine.net), using qconfirm-inject, to [email protected]:

info msg 3651500: bytes 407 from <[email protected]@[]> qp 77658 uid 1000
starting delivery 235298: msg 3651500 to local [email protected]

qconfirm sends a confirmation message from jsmith's account:

info msg 3652030: bytes 1431 from <> qp 77663 uid 888
starting delivery 235299: msg 3652030 to local dcj-qnotice-b71150b-testguy-jsmith=test.palomine.net@palomine.net

Notice the VERP part of the address that qmail created is
testguy-jsmith=test.palomine.net, not jsmith=test.palomine.net. qmail has added the
prepend in the VERP address.

When this confirmation message is received back in my account, this appears in the logs:

delivery 235299: failure: Sorry,_no_mailbox_here_by_that_name:_testguy-jsmith=test:palomine:net/

I presume this happens because qconfirm-notice doesn't know that it's ever sent
mail to [email protected] knows only that it sent mail to
[email protected].

At first glance, this would appear to be a qmail bug. I'd think that ezmlm's
bounce handling wouldn't work if a subscriber to a list is on a virtual domain
on the same server that hosts the lists.

This just in! I found this in the qmail archives: http://www.geocrawler.com/archives/3/513/2001/8/1200/6367356/
Apparently I'm not the first to have discovered this.

Chris