diff --git a/shell/ash.c b/shell/ash.c
index d29de37b7..c731a333b 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -7028,6 +7028,7 @@ varunset(const char *end, const char *var, const char *umsg, int varflags)
 			msg = umsg;
 		}
 	}
+	ifsfree();
 	ash_msg_and_raise_error("%.*s: %s%s", (int)(end - var - 1), var, msg, tail);
 }
 
@@ -7453,6 +7454,7 @@ varvalue(char *name, int varflags, int flags, int quoted)
 		if (discard)
 			return -1;
 
+		ifsfree();
 		raise_error_syntax("bad substitution");
 	}
 
diff --git a/shell/ash_test/ash-heredoc/heredoc_and_cmd.right b/shell/ash_test/ash-heredoc/heredoc_and_cmd.right
new file mode 100644
index 000000000..25ae70561
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_and_cmd.right
@@ -0,0 +1,2 @@
+./heredoc_and_cmd.tests: line 4: D: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+Y
diff --git a/shell/ash_test/ash-heredoc/heredoc_and_cmd.tests b/shell/ash_test/ash-heredoc/heredoc_and_cmd.tests
new file mode 100755
index 000000000..197542de7
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc_and_cmd.tests
@@ -0,0 +1,8 @@
+# The bug was only happening with <<REDIR;CMD form below:
+M='AAAAAAAAAAAAAAAAA'
+fff(){
+date <<000; echo Y
+${D?$M$M$M$M$M$M}
+000
+}
+fff
diff --git a/shell/hush_test/hush-heredoc/heredoc_and_cmd.right b/shell/hush_test/hush-heredoc/heredoc_and_cmd.right
new file mode 100644
index 000000000..5c19a0621
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_and_cmd.right
@@ -0,0 +1,2 @@
+hush: D: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+Y
diff --git a/shell/hush_test/hush-heredoc/heredoc_and_cmd.tests b/shell/hush_test/hush-heredoc/heredoc_and_cmd.tests
new file mode 100755
index 000000000..197542de7
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_and_cmd.tests
@@ -0,0 +1,8 @@
+# The bug was only happening with <<REDIR;CMD form below:
+M='AAAAAAAAAAAAAAAAA'
+fff(){
+date <<000; echo Y
+${D?$M$M$M$M$M$M}
+000
+}
+fff