Index: unix/xserver/hw/vnc/Input.cc
===================================================================
--- unix/xserver/hw/vnc/Input.cc	(revision 3923)
+++ unix/xserver/hw/vnc/Input.cc	(revision 3924)
@@ -373,6 +373,14 @@
 	unsigned int i, n;
 	int j, k, action;
 
+	/* 
+	 * Since we are checking the current state to determine if we need
+	 * to fake modifiers, we must make sure that everything put on the
+	 * input queue is processed before we start. Otherwise, shift may be
+	 * stuck down.
+	 */ 
+	mieqProcessInputEvents();
+
 	if (keysym == XK_Caps_Lock) {
 		vlog.debug("Ignoring caps lock");
 		return;
@@ -506,6 +514,15 @@
 	action = down ? KeyPress : KeyRelease;
 	n = GetKeyboardEvents(eventq, dev, action, kc);
 	enqueueEvents(dev, n);
+	
+	/*
+	 * When faking a modifier we are putting a keycode (which can
+	 * currently activate the desired modifier) on the input
+	 * queue. A future modmap change can change the mapping so
+	 * that this keycode means something else entirely. Guard
+	 * against this by processing the queue now.
+	 */
+	mieqProcessInputEvents();
 }
 
 static KeySym KeyCodetoKeySym(KeySymsPtr keymap, int keycode, int col)