diff --git a/CHANGES b/CHANGES
index f8e4444f1d..eee6aba604 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,19 @@
 
+2.1-6 | 2012-09-06 23:23:14 -0700
+
+  * Fixed a bug where "a -= b" (both operands are intervals) was not
+    allowed in Bro scripts (although "a = a - b" is allowed). (Daniel
+    Thayer)
+
+  * Fixed a bug where the "!=" operator with subnet operands was
+    treated the same as the "==" operator. (Daniel Thayer)
+
+  * Add sleeps to configuration_update test for better reliability.
+    (Jon Siwek)
+
+  * Fix a segfault when iterating over a set when using malformed
+    index. (Daniel Thayer)
+
 2.1 | 2012-08-28 16:46:42 -0700
 
   * Make bif.identify_magic robust against FreeBSD's libmagic config.
diff --git a/VERSION b/VERSION
index 879b416e60..d218cbd5c8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.1
+2.1-6
diff --git a/src/Expr.cc b/src/Expr.cc
index b62f119bae..e6936267d8 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -872,10 +872,12 @@ Val* BinaryExpr::SubNetFold(Val* v1, Val* v2) const
 	const IPPrefix& n1 = v1->AsSubNet();
 	const IPPrefix& n2 = v2->AsSubNet();
 
-	if ( n1 == n2 )
-		return new Val(1, TYPE_BOOL);
-	else
-		return new Val(0, TYPE_BOOL);
+	bool result = ( n1 == n2 ) ? true : false;
+
+	if ( tag == EXPR_NE )
+		result = ! result;
+
+	return new Val(result, TYPE_BOOL);
 	}
 
 void BinaryExpr::SwapOps()
@@ -1515,6 +1517,8 @@ RemoveFromExpr::RemoveFromExpr(Expr* arg_op1, Expr* arg_op2)
 
 	if ( BothArithmetic(bt1, bt2) )
 		PromoteType(max_type(bt1, bt2), is_vector(op1) || is_vector(op2));
+	else if ( BothInterval(bt1, bt2) )
+		SetType(base_type(bt1));
 	else
 		ExprError("requires two arithmetic operands");
 	}
diff --git a/src/Stmt.cc b/src/Stmt.cc
index 582323bf91..7d754d8e72 100644
--- a/src/Stmt.cc
+++ b/src/Stmt.cc
@@ -943,7 +943,10 @@ ForStmt::ForStmt(id_list* arg_loop_vars, Expr* loop_expr)
 		{
 		const type_list* indices = e->Type()->AsTableType()->IndexTypes();
 		if ( indices->length() != loop_vars->length() )
+			{
 			e->Error("wrong index size");
+			return;
+			}
 
 		for ( int i = 0; i < indices->length(); i++ )
 			{
diff --git a/testing/btest/scripts/base/frameworks/control/configuration_update.bro b/testing/btest/scripts/base/frameworks/control/configuration_update.bro
index 920a162503..d9e62efe08 100644
--- a/testing/btest/scripts/base/frameworks/control/configuration_update.bro
+++ b/testing/btest/scripts/base/frameworks/control/configuration_update.bro
@@ -1,7 +1,9 @@
 # @TEST-SERIALIZE: comm
 #
 # @TEST-EXEC: btest-bg-run controllee  BROPATH=$BROPATH:.. bro %INPUT frameworks/control/controllee Communication::listen_port=65531/tcp 
+# @TEST-EXEC: sleep 5
 # @TEST-EXEC: btest-bg-run controller  BROPATH=$BROPATH:.. bro %INPUT test-redef frameworks/control/controller Control::host=127.0.0.1 Control::host_port=65531/tcp Control::cmd=configuration_update
+# @TEST-EXEC: sleep 5
 # @TEST-EXEC: btest-bg-run controller2 BROPATH=$BROPATH:.. bro %INPUT frameworks/control/controller Control::host=127.0.0.1 Control::host_port=65531/tcp Control::cmd=shutdown
 # @TEST-EXEC: btest-bg-wait 10
 # @TEST-EXEC: btest-diff controllee/.stdout