Re: verify=recipient/callout,hold fails in 4.99

Hi Jeremy,

> I think you've hit the item that post-4.99 JH/15 fixed:  d2353fcd8f60
> 
> +JH/15 Fix use of a verify held-open connection. When used with TLS the
> +      details of the connection were not being properly passed to a later
> +      delivery process, resulting in a null-indirection fault.
> 
> This would likely be present in 4.99.3 as that only adds security fixes over
> 4.99.  Options include
> 
> - trying to cherry-pick that commit onto 4.99.3 and building
> - building the current master
> - sticking with the workaround of disabling "hold"

I tried to apply the patch
https://code.exim.org/exim/exim/commit/d2353fcd8f602a1f4fdeb31ae006e6b7bc46b349.patch

got compilation error:

verify.c:1162:46: error: no member named 'dane_verified' in 'tls_support'
 1162 |         cutthrough.is_dane =    tls_out.sni && tls_out.dane_verified;
      |                                                ~~~~~~~ ^

because I compile Exim without DANE and DNSSEC.
Then I patched the patched file:

--- verify.c.neizmen    2026-05-28 16:49:00.000000000 +0300
+++ verify.c    2026-05-28 17:04:16.676681000 +0300
@@ -1159,7 +1159,11 @@
       cutthrough.callout_hold_only = !cutthrough.delivery;
       if ((cutthrough.is_tls = tls_out.active.sock >= 0))
        {
+#ifdef SUPPORT_DANE
        cutthrough.is_dane =    tls_out.sni && tls_out.dane_verified;
+#else
+       cutthrough.is_dane =    0;
+#endif
        cutthrough.sni =        tls_out.sni;
        cutthrough.cipher =     tls_out.cipher;
        }

Now the ",hold" works. Thank you.