Hi. I would probably rename the patch to "03-cve-2016-8859" for unstable (lowercase, and without .patch suffix, as none of the already existing patches have it). Some day I will "convert" all my packages to be more "mainstream", but I prefer to be consistent for now. Other than that, thanks a lot! Thanks.