Postfix SMTP smuggling via smtpd_proxy_filter when the before-filter SMTP server adds a Require-TLS-ESMTP: yes message header, which is enabled by the default requiretls_esmtp_header = yes setting. The header-prepend path in smtpd_proxy_rec_put() was not gated on a true line start, so implementation edge cases allowed smuggling. smtpd_proxy_filter is disabled by default. Fixed in src/smtpd/smtpd_proxy.c by gating the REQTLS header handling on proxy->last_text_rec != REC_TYPE_CONT.