fix mailbox leak causing assert crash (RHEL-176273)

Resolves: RHEL-176273

dovecot-2.3.16-fixrefcount.patch

@@ -0,0 +1,12 @@
+diff --git a/src/imap/cmd-copy.c b/src/imap/cmd-copy.c
+index 59a4c7ef753..1ce018ba744 100644
+--- a/src/imap/cmd-copy.c
++++ b/src/imap/cmd-copy.c
+@@ -309,6 +309,7 @@ static bool cmd_copy_full(struct client_command_context *cmd, bool move)
+ 			mail_search_args_unref(&search_args);
+ 			client_send_box_error(cmd, copy_ctx.srcbox);
+ 			mailbox_free(&copy_ctx.srcbox);
++			mailbox_free(&destbox);
+ 			return TRUE;
+ 		}
+ 	}

dovecot.spec

@@ -5,7 +5,7 @@ Name: dovecot
 Epoch: 1
 Version: 2.3.16
 %global prever %{nil}
-Release: 8%{?dist}
+Release: 9%{?dist}
 #dovecot itself is MIT, a few sources are PD, pigeonhole is LGPLv2
 License: MIT and LGPLv2
 Group: System Environment/Daemons
@@ -91,6 +91,9 @@ Patch30: dovecot-2.3-cve-2026-27857p5of5.patch
 # from upstream for < 2.4.4, RHEL-188480
 # https://github.com/dovecot/core/commit/9a0f8c1066956ea7450ca82b57f904332006a502
 Patch31: dovecot-2.3-cve-2026-42006.patch
+# from upstream for < 2.3.17, RHEL-176273
+# https://github.com/dovecot/core/commit/b401e4136fea3d6ceffcc139bdebf1df422dd221
+Patch32: dovecot-2.3.16-fixrefcount.patch
 
 Source15: prestartscript
 
@@ -217,6 +220,7 @@ mv dovecot-2.3-pigeonhole-%{pigeonholever} dovecot-pigeonhole
 %patch -P 29 -p1 -b .cve-2026-27857p4of5
 %patch -P 30 -p1 -b .cve-2026-27857p5of5
 %patch -P 31 -p1 -b .cve-2026-42006
+%patch -P 32 -p1 -b .fixrefcount
 
 sed -i '/DEFAULT_INCLUDES *=/s|$| '"$(pkg-config --cflags libclucene-core)|" src/plugins/fts-lucene/Makefile.in
 
@@ -577,6 +581,9 @@ make check
 %{_libdir}/%{name}/dict/libdriver_pgsql.so
 
 %changelog
+* Sat Jul 25 2026 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-9
+- fix mailbox leak causing assert crash (RHEL-176273)
+
 * Fri Jun 26 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1:2.3.16-8
 - fix CVE-2026-42006: fix IMAP parser list_count_limit to correctly
   limit open braces instead of close braces (RHEL-188480)