diff --git a/NEWS.md b/NEWS.md
index 43095040..3daab0f7 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -174,6 +174,19 @@ are length-bounded; peer-requested xattr expansion is capped; and rsync-ssl in
 stunnel mode now requires certificate verification unless an explicit insecure
 opt-out is set.
 
+A second-pass source audit (reported by Leonid Bugaev) hardened several memory-
+safety and robustness paths: the hashtable and file-list size computations are
+guarded against a 32-bit integer overflow that a peer's entry count could
+otherwise wrap into an under-allocation; a non-positive `MSG_IO_TIMEOUT` from the
+peer is rejected rather than disabling the receiver's own I/O timeout; and the
+`SIGUSR2` handler is now async-signal-safe (it only sets a flag, deferring the
+summary/close-out work to safe poll points).  Separately, the xattr/ACL metadata
+copy now reads the *source* through a held no-follow fd as well as writing the
+destination through one -- closing a parent-symlink race on the `--copy-dest` and
+backup source -- and the cross-tree operator-path metadata apply is now fd-pinned
+under `--fake-super` too (previously it fell back to a path-based set for a
+`fake super = yes` daemon staging through an absolute `--temp-dir`/`--backup-dir`).
+
 ### BEHAVIOR CHANGES:
 
 - A non-daemon receiver follows an operator-named symlinked destination directory
diff --git a/SECURITY.md b/SECURITY.md
index eb57ff2f..5bd0a23a 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -400,7 +400,14 @@ The following are documented as out of scope for this release:
   `copy_file()`/`copy_xattrs()` source read goes through the held basis content fd
   (`sys_fgetxattr`), and `make_backup()` reads the backed-up file's ACL/xattrs
   through a `backup_source_fd()`-pinned fd -- so a parent-component flip can no
-  longer redirect them to disclose an out-of-module value.  Two narrow follow-ons
+  longer redirect them to disclose an out-of-module value.  The cross-tree
+  metadata *apply* on those leaves (the `%stat`/ACL/xattr write on a
+  `--temp-dir`/`--backup-dir` staging file) is fd-pinned the same way, now
+  including under `--fake-super`: the `set_file_attrs()` no-follow leaf fd was
+  previously opened only when `am_root >= 0`, so a `fake super = yes` daemon fell
+  back to a path-based `sys_lsetxattr()`/chmod a raced parent could redirect; the
+  pin is now opened for fake-super too (a raced leaf is refused, not redirected).
+  Two narrow follow-ons
   re-resolve the (now-validated) operator path by name and remain a
   *post-validation* parent-component race:
     * the in-place backup (`--inplace --backup`) writes the backup file's data