untrusted comment: signature from openbsd 6.0 base secret key
RWSho3oKSqgLQ9/BL5Z2N1Vqrq9/VPCrm8vQH/xbQmz0cHARb1rzkdBhQTO8UyTz9kI1WL4il5POleO3os0fnr/Rpp+gClLdJwk=

OpenBSD 6.0 errata 4, Aug 23, 2016:

A missing initialization can prevent mail headers from being altered
as intended, resulting in mail being sent to incorrect addresses.

Apply by doing:
   signify -Vep /etc/signify/openbsd-60-base.pub -x 004_smtpd.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install smtpd:
   cd /usr/src/usr.sbin/smtpd
   make obj
   make depend
   make
   make install

Index: usr.sbin/smtpd/rfc2822.c
===================================================================
RCS file: /cvs/src/usr.sbin/smtpd/rfc2822.c,v
retrieving revision 1.7
diff -u -p -r1.7 rfc2822.c
--- usr.sbin/smtpd/rfc2822.c    4 Feb 2016 22:35:17 -0000       1.7
+++ usr.sbin/smtpd/rfc2822.c    22 Aug 2016 15:23:41 -0000
@@ -138,6 +138,7 @@ rfc2822_parser_init(struct rfc2822_parse
       TAILQ_INIT(&rp->header.lines);
       rfc2822_header_default_callback(rp, hdr_dflt_cb, NULL);
       rfc2822_body_callback(rp, body_dflt_cb, NULL);
+       rfc2822_parser_reset(rp);
}

void