http://bugs.squid-cache.org/show_bug.cgi?id=3678

diff --git a/src/external_acl.cc b/src/external_acl.cc
index d6c4338..1f1f2b4 100644
--- a/src/external_acl.cc
+++ b/src/external_acl.cc
@@ -830,8 +830,11 @@ aclMatchExternal(external_acl_data *acl, ACLFilledChecklist *ch)
             if (acl->def->theHelper->stats.queue_size <= (int)acl->def->theHelper->childs.n_active) {
                 debugs(82, 2, "aclMatchExternal: \"" << key << "\": queueing a call.");
                 ch->changeState(ExternalACLLookup::Instance());
-                debugs(82, 2, "aclMatchExternal: \"" << key << "\": return -1.");
-                return -1; // to get here we have to have an expired cache entry. MUST not use.
+                if (!entry) {
+                    debugs(82, 2, "aclMatchExternal: \"" << key << "\": return -1.");
+                    return -1; // to get here we have to have an expired cache entry. MUST not use.
+                }
+                /* Grace period fall thru to return cached entry */
             } else {
                 if (!entry) {
                     debugs(82, 1, "aclMatchExternal: '" << acl->def->name <<
@@ -1409,8 +1412,7 @@ ACLExternal::ExternalAclLookup(ACLChecklist *checklist, ACLExternal * me, EAH *
     if (entry && external_acl_grace_expired(def, entry)) {
         if (oldstate) {
             debugs(82, 4, "externalAclLookup: in grace period, but already pending lookup ('" << key << "', ch=" << ch << ")");
-            callback(callback_data, entry);
-            return;
+            goto return_grace;
         } else {
             graceful = 1; // grace expired, (neg)ttl did not, and we must start a new lookup.
         }
@@ -1419,10 +1421,9 @@ ACLExternal::ExternalAclLookup(ACLChecklist *checklist, ACLExternal * me, EAH *
     // The entry is in the cache, grace_ttl did not expired.
     if (!graceful && entry && !external_acl_grace_expired(def, entry)) {
         /* Should not really happen, but why not.. */
-        callback(callback_data, entry);
         debugs(82, 4, "externalAclLookup: no lookup pending for '" << key << "', and grace not expired");
         debugs(82, 4, "externalAclLookup: (what tha' hell?)");
-        return;
+        goto return_grace;
     }
 
     /* No pending lookup found. Sumbit to helper */
@@ -1447,8 +1448,7 @@ ACLExternal::ExternalAclLookup(ACLChecklist *checklist, ACLExternal * me, EAH *
         if (def->theHelper->stats.queue_size >= (int)def->theHelper->childs.n_running) {
             debugs(82, 1, "externalAclLookup: '" << def->name << "' queue overload (ch=" << ch << ")");
             cbdataFree(state);
-            callback(callback_data, entry);
-            return;
+            goto return_grace;
         }
 
         /* Send it off to the helper */
@@ -1469,8 +1469,8 @@ ACLExternal::ExternalAclLookup(ACLChecklist *checklist, ACLExternal * me, EAH *
         /* No need to wait during grace period */
         debugs(82, 4, "externalAclLookup: no need to wait for the result of '" <<
                key << "' in '" << def->name << "' (ch=" << ch << ").");
+return_grace:
         debugs(82, 4, "externalAclLookup: using cached entry " << entry);
-
         if (entry != NULL) {
             debugs(82, 4, "externalAclLookup: entry = { date=" <<
                    (long unsigned int) entry->date <<