diff --git a/bandb/bantool.c b/bandb/bantool.c
index 3b7f949a..81797449 100644
--- a/bandb/bantool.c
+++ b/bandb/bantool.c
@@ -38,7 +38,6 @@
  *
  */
 
-#define _XOPEN_SOURCE
 #include <stdio.h>
 #include <stdlib.h>
 #include <time.h>
diff --git a/modules/core/m_join.c b/modules/core/m_join.c
index c4308b07..070d8588 100644
--- a/modules/core/m_join.c
+++ b/modules/core/m_join.c
@@ -639,12 +639,15 @@ ms_sjoin(struct Client *client_p, struct Client *source_p, int parc, const char
 	{
 		/* If configured, kick people trying to join +i/+k
 		 * channels by recreating them on split servers.
-		 * Don't kick if the source has sent EOB (services
-		 * deopping everyone by TS-1 SJOIN).
+		 * If the source has sent EOB, assume this is some
+		 * sort of hack by services. If cmode +i is set,
+		 * services can send kicks if needed; if the key
+		 * differs, services cannot kick in a race-free
+		 * manner so do so here.
 		 * -- jilles */
 		if (ConfigChannel.kick_on_split_riding &&
-				!HasSentEob(source_p) &&
-				((mode.mode & MODE_INVITEONLY) ||
+				((!HasSentEob(source_p) &&
+				mode.mode & MODE_INVITEONLY) ||
 		    (mode.key[0] != 0 && irccmp(mode.key, oldmode->key) != 0)))
 		{
 			struct membership *msptr;
diff --git a/modules/m_sasl.c b/modules/m_sasl.c
index 41bf823d..8dbbf0e7 100644
--- a/modules/m_sasl.c
+++ b/modules/m_sasl.c
@@ -106,8 +106,15 @@ mr_authenticate(struct Client *client_p, struct Client *source_p,
 		agent_p = find_id(source_p->preClient->sasl_agent);
 
 	if(agent_p == NULL)
-		sendto_server(NULL, NULL, CAP_TS6|CAP_ENCAP, NOCAPS, ":%s ENCAP * SASL %s * S %s", me.id,
-				source_p->id, parv[1]);
+	{
+		if (!strcmp(parv[1], "EXTERNAL") && source_p->certfp != NULL)
+			sendto_server(NULL, NULL, CAP_TS6|CAP_ENCAP, NOCAPS, ":%s ENCAP * SASL %s * S %s %s", me.id,
+					source_p->id, parv[1],
+					source_p->certfp);
+		else
+			sendto_server(NULL, NULL, CAP_TS6|CAP_ENCAP, NOCAPS, ":%s ENCAP * SASL %s * S %s", me.id,
+					source_p->id, parv[1]);
+	}
 	else
 		sendto_one(agent_p, ":%s ENCAP %s SASL %s %s C %s", me.id, agent_p->servptr->name,
 				source_p->id, agent_p->id, parv[1]);
diff --git a/src/match.c b/src/match.c
index a0509c48..18d7472f 100644
--- a/src/match.c
+++ b/src/match.c
@@ -684,7 +684,7 @@ const unsigned int CharAttrs[] = {
 /* 26 */ CNTRL_C | CHAN_C | NONEOS_C,
 /* 27 */ CNTRL_C | CHAN_C | NONEOS_C,
 /* 28 */ CNTRL_C | CHAN_C | NONEOS_C,
-/* 29 */ CNTRL_C | CHAN_C | NONEOS_C,
+/* 29 */ CNTRL_C | CHAN_C | FCHAN_C | NONEOS_C,
 /* 30 */ CNTRL_C | CHAN_C | NONEOS_C,
 /* 31 */ CNTRL_C | CHAN_C | FCHAN_C | NONEOS_C,
 /* SP */ PRINT_C | SPACE_C,