[Exim] Hmmm

I was trying to get Amavis-ng working either in Exim::Perl mode, or flat
Exim mode using the scanned-ok hack. If I use Exim::Perl mode then messages
that I *KNOW* contain viruses get through. If I use Exim mode it dies. I was
trying to debug exim mode and noticed something in the debug output:

amavis transport entered
direct command:
argv[0] = /usr/sbin/amavis
argv[1] = -f
argv[2] = ${sender_address}
argv[3] = -d
argv[4] = ${pipe_addresses}
direct command after expansion:
argv[0] = /usr/sbin/amavis
argv[1] = -f
argv[2] =
argv[3] = -d
argv[4] = dan@???
set_process_info: 4678 reading output from |/usr/sbin/amavis -f
${sender_address} -d ${pipe_addresses}
Writing message to pipe
writing data block fd=13 size=0 timeout=3600
writing data block fd=13 size=1738 timeout=3600
writing error 32: Broken pipe

There's two things I'm seeing, probably related to each other:
1) Look at the arguments being passed to Amavis. -f <blank>. So no sender
address, and 2) "writing error 32: Broken Pipe"

Now I'm at a loss to explain why ${sender_address} is not populating
properly. Although one thing I noticed that seems wrong:
the message was not TO dan@???, but FROM that address TO
another address. I am CCing this to the Exim list in case someone there can
help to explain why the variables are populated wrong.

Thanks all!!
-- Dan