diff --git a/src/drv_imap.c b/src/drv_imap.c
index 29c01d4..3e14a64 100644
--- a/src/drv_imap.c
+++ b/src/drv_imap.c
@@ -1312,9 +1312,10 @@ imap_socket_read( void *aux )
 			error( "IMAP error: unexpected reply: %s %s\n", arg, cmd ? cmd : "" );
 			break; /* this may mean anything, so prefer not to spam the log */
 		} else if (*arg == '+') {
-			/* This can happen only with the last command underway, as
-			   it enforces a round-trip. */
-			cmdp = ctx->in_progress;
+			/* There can be any number of commands in flight, but only the last
+			 * one can require a continuation, as it enforces a round-trip. */
+			cmdp = (struct imap_cmd *)((char *)ctx->in_progress_append -
+			                           offsetof(struct imap_cmd, next));
 			if (cmdp->param.data) {
 				if (cmdp->param.to_trash)
 					ctx->trashnc = TrashKnown; /* Can't get NO [TRYCREATE] any more. */
diff --git a/src/main.c b/src/main.c
index f587e2d..59a13e1 100644
--- a/src/main.c
+++ b/src/main.c
@@ -750,7 +750,7 @@ store_opened( store_t *ctx, void *aux )
 			const char *pat = cpat->string;
 			if (*pat != '!') {
 				char buf[8];
-				int bufl = snprintf( buf, sizeof(buf), "%s%s", mvars->chan->boxes[t], pat );
+				int bufl = snprintf( buf, sizeof(buf), "%s%s", nz( mvars->chan->boxes[t], "" ), pat );
 				/* Partial matches like "INB*" or even "*" are not considered,
 				 * except implicity when the INBOX lives under Path. */
 				if (starts_with( buf, bufl, "INBOX", 5 )) {
diff --git a/src/mbsyncrc.sample b/src/mbsyncrc.sample
index 1c155e9..c7d61c7 100644
--- a/src/mbsyncrc.sample
+++ b/src/mbsyncrc.sample
@@ -16,11 +16,11 @@ Pass xxxxxxxx
 # Fetch password from gnome-keyring:
 #PassCmd "gnome-keyring-query get mail_pw"
 # Fetch password from .netrc:
-#PassCmd "sed -n -e 's,^machine work\.host\.com login tehuser password \(.*\),\1,p' < $HOME/.netrc"
+#PassCmd "sed -n -e 's,^machine work\\.host\\.com login tehuser password \\(.*\\),\\1,p' < $HOME/.netrc"
 # Fetch password from a gpg-encrypted file:
 #PassCmd "gpg --quiet --for-your-eyes-only --decrypt $HOME/imappassword.gpg"
 # Fetch password from pwmd (http://pwmd.sourceforge.net/):
-#PassCmd "echo -ne 'GET myIsp\tpassword' | pwmc datafile"
+#PassCmd "echo -ne 'GET myIsp\\tpassword' | pwmc datafile"
 # On Mac OS X, run "KeyChain Access" -- File->New Password Item. Fill out form using
 #  "Keychain Item Name" http://IMAPSERVER  (note: the "http://" is a hack)
 #  "Account Name" USERNAME