[exim] NUL characters in headers?

Hello.

I am using Cyrus for mailboxes and Exim 4.67 to deliver mail.
There was a problem with NUL characters in messages body:
when Exim tried to deliver it to Cyrus mailbox, Cyrus rejected
the message with "554 5.6.0 Message contains NUL characters" reply.

I've done a workaround for this problem by creating this ACL entry:

  # Prevent generating bounces during delivery to cyrus storage
  deny
    message = This message contains NUL characters [#1052].
    condition = ${if >{$body_zerocount}{0} }

But now I see rejects from Cyrus appearing anyway, along with rejects
from ACL (second reject comes from Cyrus):

Sep 10 01:49:48 counter exim-mta-mx3[19730]: 1IUUf4-00058E-KT H=atoulon-151-1-126-78.w86-206.abo.wanadoo.fr [86.206.201.78] F=<akhil@???> rejected after DATA: This message contains NUL characters [#1052].
Sep 10 09:32:55 counter exim-mta-mx3[71638]: 1IUbtE-000IcB-Qa ** s7700700_012@??? R=cyrususer T=cyrus_delivery: LMTP error after end of data: 554 5.6.0 Message contains NUL characters

How can this happen? Maybe there are NUL characters in headers section
and Exim does not count them? I have no idea how to catch these messages
at this moment, probably later I'd could.

Has anyone meet this problem?

--
Cronfy.