When using the result of a variable substitution is used on the right hand side of a I/O redirection, the destination file name has a trialing garbage byte appended.

Consider the following testcase:

root@uplink:~# /bin/sh


BusyBox v1.19.4 (2012-05-27 23:56:19 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# make sure there is no file already
root@uplink:~# rm -f /tmp/tmp1*

# test the substitutions with echo - working fine
root@uplink:~# x="tmp1:tmp2"; echo "${x#*:}" "/tmp/${x%:*}"
tmp2 /tmp/tmp1

# now trying to echo word #1 into word #2
root@uplink:~# x="tmp1:tmp2"; echo "${x#*:}" > "/tmp/${x%:*}"

# manually typing the expected destination:
root@uplink:~# cat /tmp/tmp1
cat: can't open '/tmp/tmp1': No such file or directory

# using arrow up and tab expansion my gnome terminal shows a trailing \210 byte:
root@uplink:~# cat /tmp/tmp1\210
tmp2

# using file globbing and hexdump confirms the bad path
root@uplink:~# echo -n /tmp/tmp1* | hexdump -C
00000000  2f 74 6d 70 2f 74 6d 70  31 88                    |/tmp/tmp1.|
0000000a


I have not digged into the relevant code so I can not yet suggest a more specific direction to look into.