Problematic URI parsing in iPXE, redirect2 ends up as a query param to url3, it should stay with url2

gistfile1.txt

#!ipxe
set url1 http://boot.smidsrod.lan/path1?key1=value1#frag1
set url2 http://boot.smidsrod.lan/path2?key2=value2&redirect2=${url1:uristring}#frag2
set url3 http://boot.smidsrod.lan/path3?key3=value3&redirect3=${url2:uristring}#frag3
chain ${url3} ||
shell

Result: http://boot.smidsrod.lan/path3?key3=value3&redirect3=http%3A//boot.smidsrod.lan/path2%3Fkey2=value2&redirect2=http%3A//boot.smidsrod.lan/path1%3Fkey1=value1#frag1%23frag2%23frag3

Expected url2: http://boot.smidsrod.lan/path2?key2=value2&redirect2=http%3A%2F%2Fboot.smidsrod.lan%2Fpath1%3Fkey1%3Dvalue1%23frag1#frag2
Expected url3: http://boot.smidsrod.lan/path3?key3=value3&redirect3=http%3A%2F%2Fboot.smidsrod.lan%2Fpath2%3Fkey2%3Dvalue2%26redirect2%3Dhttp%253A%252F%252Fboot.smidsrod.lan%252Fpath1%253Fkey1%253Dvalue1%2523frag1%23frag2#frag3

Problem case without fragments:

set url1 http://boot.smidsrod.lan/path1?key1=value1
set url2 http://boot.smidsrod.lan/path2?key2=value2&redirect2=${url1:uristring}
set url3 http://boot.smidsrod.lan/path3?key3=value3&redirect3=${url2:uristring}
chain ${url3} ||
shell

Expected url2: http://boot.smidsrod.lan/path2?key2=value2&redirect2=http%3A%2F%2Fboot.smidsrod.lan%2Fpath1%3Fkey1%3Dvalue1
Expected url3: http://boot.smidsrod.lan/path3?key3=value3&redirect3=http%3A%2F%2Fboot.smidsrod.lan%2Fpath2%3Fkey2%3Dvalue2%26redirect2%3Dhttp%253A%252F%252Fboot.smidsrod.lan%252Fpath1%253Fkey1%253Dvalue1
From commit ff341c1 (old, also broken):
Actual   url3: http://boot.smidsrod.lan/path3?key3=value3&redirect3=http%3A%2F%2Fboot.smidsrod.lan%2Fpath2%3Fkey2=value2&redirect2=http%253A%252F%252Fboot.smidsrod.lan%252Fpath1%253Fkey1%253Dvalue1
From commit 27d1b40 (new, more broken):
Actual   url3: http://boot.smidsrod.lan/path3?key3=value3&redirect3=http%3A//boot.smidsrod.lan/path2%3Fkey2=value2&redirect2=http%3A//boot.smidsrod.lan/path1%3Fkey1=value1