--- a/src/imap/client.c	Sun Mar 25 23:26:53 2007 +0300
+++ b/src/imap/client.c	Mon Mar 26 00:53:11 2007 +0300
@@ -367,16 +367,10 @@
 	if (!cmd->param_error)
 		client->bad_counter = 0;
 
-	if (client->input_lock == cmd) {
-		/* reset the input handler in case it was changed */
+	if (client->input_lock == cmd)
 		client->input_lock = NULL;
-	}
-	if (client->output_lock == cmd) {
-		/* reset the output handler in case it was changed */
-		o_stream_set_flush_callback(client->output,
-					    _client_output, client);
+	if (client->output_lock == cmd)
 		client->output_lock = NULL;
-	}
 
 	if (client->free_parser != NULL)
 		imap_parser_destroy(&cmd->parser);
@@ -619,7 +613,7 @@
 
 int _client_output(struct client *client)
 {
-	struct client_command_context *cmd;
+	struct client_command_context *cmd, *next;
 	int ret;
 
 	i_assert(!client->destroyed);
@@ -636,7 +630,8 @@
 		client_output_cmd(client->output_lock);
 	if (client->output_lock == NULL) {
 		cmd = client->command_queue;
-		for (; cmd != NULL; cmd = cmd->next) {
+		for (; cmd != NULL; cmd = next) {
+			next = cmd->next;
 			client_output_cmd(cmd);
 			if (client->output_lock != NULL)
 				break;

--- a/src/imap/cmd-append.c	Sun Mar 25 23:26:53 2007 +0300
+++ b/src/imap/cmd-append.c	Mon Mar 26 00:53:11 2007 +0300
@@ -118,6 +118,10 @@
 	i_assert(ctx->client->input_lock == ctx->cmd);
 
 	io_remove(&ctx->client->io);
+	/* we must put back the original flush callback before beginning to
+	   sync (the command is still unfinished at that point) */
+	o_stream_set_flush_callback(ctx->client->output,
+				    _client_output, ctx->client);
 
 	if (ctx->input != NULL)
 		i_stream_unref(&ctx->input);