Set req.backend_hint from the VCL we switch to.

Spotted by:	dridi

Fixes:	#2175

bin/varnishd/cache/cache_req_fsm.c

@@ -691,8 +691,11 @@ cnt_recv(struct worker *wrk, struct req *req)
 	}
 
 	VCL_recv_method(req->vcl, wrk, req, NULL, NULL);
-	if (wrk->handling == VCL_RET_VCL)
+	if (wrk->handling == VCL_RET_VCL) {
+		req->director_hint = VCL_DefaultDirector(req->vcl);
+		AN(req->director_hint);
 		VCL_recv_method(req->vcl, wrk, req, NULL, NULL);
+	}
 
 	/* Attempts to cache req.body may fail */
 	if (req->req_body_status == REQ_BODY_FAIL) {

bin/varnishtest/tests/r02175.vtc

+varnishtest "leak backend"
+
+server s1 {
+	rxreq
+	txresp -hdr "Leak: no"
+} -start
+
+server s2 {
+	rxreq
+	txresp -hdr "Leak: yes"
+} -start
+
+varnish v1 -vcl {
+	backend s1 { .host="${s1_addr}"; .port="${s1_port}"; }
+
+	sub vcl_deliver {
+		set resp.http.Label = "yes";
+	}
+}
+
+varnish v1 -cli "vcl.label lbl vcl1"
+
+varnish v1 -vcl {
+	backend s2 { .host="${s2_addr}"; .port="${s2_port}"; }
+
+	sub vcl_recv {
+		set req.backend_hint = s2;
+		return (vcl(lbl));
+	}
+
+	sub vcl_deliver {
+		set resp.http.Label = "no";
+	}
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.http.Label == yes
+	expect resp.http.Leak  == no
+} -run