Since the changes in [1], there's an issue with CTLNUL leakage in ${param=word} when word has null strings, like:
$ unset v; printf '<%q>' ${v= ''} <$'\177'> I think this can be addressed with: diff --git a/subst.c b/subst.c index 4962d2f5..58d33996 100644 --- a/subst.c +++ b/subst.c @@ -10314,7 +10314,7 @@ add_twochars: this is when we are going to be performing word splitting, since we have to preserve a null argument if the next character will cause word splitting. */ - if (temp == 0 && quoted_state == PARTIALLY_QUOTED && quoted == 0 && (word->flags & W_NOSPLIT) == 0 && (word->flags & W_EXPANDRHS)) + if (temp == 0 && quoted_state == PARTIALLY_QUOTED && quoted == 0 && (word->flags & W_NOSPLIT) == 0 && (word->flags & W_EXPANDRHS) && (word->flags & W_ASSIGNRHS) == 0) { c = CTLNUL; sindex--; @@ -10373,7 +10373,7 @@ add_twochars: partially quoted; such nulls are discarded. See above for the exception, which is when the string is going to be split. Posix interp 888/1129 */ - if (temp == 0 && quoted_state == PARTIALLY_QUOTED && quoted == 0 && (word->flags & W_NOSPLIT) == 0 && (word->flags & W_EXPANDRHS)) + if (temp == 0 && quoted_state == PARTIALLY_QUOTED && quoted == 0 && (word->flags & W_NOSPLIT) == 0 && (word->flags & W_EXPANDRHS) && (word->flags & W_ASSIGNRHS) == 0) { c = CTLNUL; sindex--; [1]: https://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=9e48f856544da2d2cc95600f487e5b5bcefa0d85