ACS imports metadata about IDPs, including their endpoints. As an FP, it duly invokes an assertion request on the endpoint, adding ws-fedp querystring argument.
If the endpoint in metadata happens to have a querystring parameter, the ACS logic fails to recognize this. It formulates a broken URL, of form:https://endpoint/?endpointqueryarg=1?signin=true& realm=foo, etc