I am relaying a privacy issue for Bitcoin Core that was [reported on r/Bitcoin](https://reddit.com/r/Bitcoin/comments/klk2wh) (Reddit).

The [message](https://pastebin.com/raw/ptFQityt) was:

- _Using coin control_
- _Custom change address_

_When one clicks the increase transaction fee button, it adds another input rather than increasing the fee by reducing the change output. Major privacy leak since you have no control of the input used._

From that it sounds like the observed behavior is that the replacement transaction includes an additional UTXO that was not chosen by the user, even though the transaction was composed as a Coin Control transaction.

So I'm assuming the expected behavior would be for Bitcoin Core to remember that this OUTPUT was actually a Custom Change Address and to then lower the amount of that OUTPUT by the amount needed for the fee bump.

And, now that I am thinking of this, isn't there the expectation that if my initial transaction was done using Coin Control, and then if my fee bump (RBF) needs another UTXO input to cover the increase in fee, that Coin Selection for that will occur (regardless of whether or not the change address was a Custom Change Address)?  
{
    return RPCHelpMan{"fundrawtransaction",
                "\nIf the transaction has no inputs, they will be automatically selected to meet its out value.\n"
                "It will add at most one change output to the outputs.\n"
                "No existing outputs will be modified unless \"subtractFeeFromOutputs\" is specified.\n"
                "Note that inputs which were signed may need to be resigned after completion since in/outputs have been added.\n"
                "The inputs added will not be signed, use signrawtransactionwithkey\n"
                "or signrawtransactionwithwallet for that.\n"
                "All existing inputs must either have their previous output transaction be in the wallet\n"
                "or be in the UTXO set. Solving data must be provided for non-wallet inputs.\n"
                "Note that all inputs selected must be of standard form and P2SH scripts must be\n"
                "in the wallet using importaddress or addmultisigaddress (to calculate fees).\n"
                "You can see whether this is the case by checking the \"solvable\" field in the listunspent output.\n"
                "Only pay-to-pubkey, multisig, and P2SH versions thereof are currently supported for watch-only\n",
                {
                    {"hexstring", RPCArg::Type::STR_HEX, RPCArg::Optional::NO, "The hex string of the raw transaction"},
                    {"options", RPCArg::Type::OBJ_NAMED_PARAMS, RPCArg::Optional::OMITTED, "For backward compatibility: passing in a true instead of an object will result in {\"includeWatching\":true}",
                        Cat<std::vector<RPCArg>>(
                        {
                            {"add_inputs", RPCArg::Type::BOOL, RPCArg::Default{true}, "For a transaction with existing inputs, automatically include more if they are not enough."},
                            {"include_unsafe", RPCArg::Type::BOOL, RPCArg::Default{false}, "Include inputs that are not safe to spend (unconfirmed transactions from outside keys and unconfirmed replacement transactions).\n"
                                                          "Warning: the resulting transaction may become invalid if one of the unsafe inputs disappears.\n"
                                                          "If that happens, you will need to fund the transaction with different inputs and republish it."},
                            {"minconf", RPCArg::Type::NUM, RPCArg::Default{0}, "If add_inputs is specified, require inputs with at least this many confirmations."},
                            {"maxconf", RPCArg::Type::NUM, RPCArg::Optional::OMITTED, "If add_inputs is specified, require inputs with at most this many confirmations."},