another type system loophole in wildcard substitution

FULL PRODUCT VERSION :
Java HotSpot(TM) Client VM (build 1.6.0-b105, mixed mode, sharing)

A DESCRIPTION OF THE PROBLEM :
There is still a loophole related to wildcard substitution.
In the attached example, Eppb's second parameter extends a box of a box of its first param. Applied to Ebbp<?,?> this means the second parameter has Box<Box<?>> as upperbound, which is wrong.

According to bug 5044625 this should already have been fixed by applying capture conversion on the left-hand side of supertype, but apparently the change there wasn't enough.


REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
public class Break {
public static void main(String[] args) {
Ebbp<A,Box<Box<A>>> realFrom = new Ebbp<A,Box<Box<A>>>(new Box<Box<A>>(new Box<A>(new A())));
caster(realFrom).q.p = new Box<B>(new B());
A a = realFrom.q.p.p;
}

static Ebbp<?,? extends Box<Box<?>>> caster(Ebbp<?,?> from) {
Box<Ebbp<?,?>> boxedFrom = new Box<Ebbp<?,?>>(from);
Box<? extends Ebbp<?,? extends Box<Box<?>>>> boxedTo = boxedFrom;
return boxedTo.p;
}
}

class Box<P> {
P p;
Box(P p) {this.p = p;}
}

class Ebbp<P, Q extends Box<Box<P>>> {
Q q;
Ebbp(Q q) {this.q = q;}
}

class A {}
class B {}
---------- END SOURCE ----------