What steps will reproduce the problem?
1. create a rewrite rule like the one below:
    <rule>
        <from>^/robots\.txt$</from>
        <to type="permanent-redirect" last="true" qsappend="true">/en/robots.txt</to>
    </rule>

2. Go to a URL which will be rewritten with the above rule, and make sure to 
use a query-string
    www.mydomain.com/robots.txt?param1=value1&param2=value2

3. Check the rewritten URL

After the rewrite we would expect to see the following URL:
    www.mydomain.com/en/robots.txt?param1=value1&param2=value2
but the "?" before the first parameter has been replaced with a "&"
    www.mydomain.com/en/robots.txt&param1=value1&param2=value2

We are using version 4.0.3 and tested on several operating systems.

Currently we fixed it ourselves by changing the code:

Class: NormalRule.java
Method: public RewrittenUrl matches(final String url, final HttpServletRequest 
hsRequest, final HttpServletResponse hsResponse, RuleChain chain) ...

Original line of code (line 99)
    ruleExecutionOutput.setReplacedUrl(target + "&" + hsRequest.getQueryString());

New code
    if (target.contains("?")) {
        ruleExecutionOutput.setReplacedUrl(target + "&" + hsRequest.getQueryString());
    } else {
        ruleExecutionOutput.setReplacedUrl(target + "?" + hsRequest.getQueryString());
    }