diff --git a/shell/ash.c b/shell/ash.c
index b404449d0..2cebfe2c0 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -11728,16 +11728,9 @@ parsesub: {
 		subtype = VSNORMAL;
 		if (c == '{') {
 			c = pgetc_eatbnl();
-			if (c == '#') {
-				c = pgetc_eatbnl();
-				if (c == '}')
-					c = '#'; /* ${#} - same as $# */
-				else
-					subtype = VSLENGTH; /* ${#VAR} */
-			} else {
-				subtype = 0;
-			}
+			subtype = 0;
 		}
+ varname:
 		if (c <= 255 /* not PEOA or PEOF */ && is_name(c)) {
 			/* $[{[#]]NAME[}] */
 			do {
@@ -11752,8 +11745,23 @@ parsesub: {
 			} while (isdigit(c));
 		} else if (is_special(c)) {
 			/* $[{[#]]<specialchar>[}] */
-			USTPUTC(c, out);
+			int cc = c;
+
 			c = pgetc_eatbnl();
+			if (!subtype && cc == '#') {
+				subtype = VSLENGTH;
+				if (c == '_' || isalnum(c))
+					goto varname;
+				cc = c;
+				c = pgetc_eatbnl();
+				if (cc == '}' || c != '}') {
+					pungetc();
+					subtype = 0;
+					c = cc;
+					cc = '#';
+				}
+			}
+			USTPUTC(cc, out);
 		} else {
 			goto badsub;
 		}
diff --git a/shell/ash_test/ash-vars/param_expand_len.right b/shell/ash_test/ash-vars/param_expand_len.right
index 96e8cb59b..48d01d2fe 100644
--- a/shell/ash_test/ash-vars/param_expand_len.right
+++ b/shell/ash_test/ash-vars/param_expand_len.right
@@ -7,3 +7,6 @@ Make sure len parsing doesnt break arg count
 Testing len op
 4 3 2 1 0 0
 0 3 0
+Nothing:
+Nothing:
+One:1
diff --git a/shell/ash_test/ash-vars/param_expand_len.tests b/shell/ash_test/ash-vars/param_expand_len.tests
index fe20a45e9..369c8d456 100755
--- a/shell/ash_test/ash-vars/param_expand_len.tests
+++ b/shell/ash_test/ash-vars/param_expand_len.tests
@@ -15,3 +15,10 @@ unset e
 f=abc
 g=
 echo ${#e} ${#f} ${#g}
+
+set -- a
+# This must be interpreted as: $# ("1"), then remove trailing "1".
+# IOW: empty result.
+echo Nothing:${##1}
+echo Nothing:${#%1}
+echo One:${##x}
diff --git a/shell/hush_test/hush-vars/param_expand_len.right b/shell/hush_test/hush-vars/param_expand_len.right
index 96e8cb59b..48d01d2fe 100644
--- a/shell/hush_test/hush-vars/param_expand_len.right
+++ b/shell/hush_test/hush-vars/param_expand_len.right
@@ -7,3 +7,6 @@ Make sure len parsing doesnt break arg count
 Testing len op
 4 3 2 1 0 0
 0 3 0
+Nothing:
+Nothing:
+One:1
diff --git a/shell/hush_test/hush-vars/param_expand_len.tests b/shell/hush_test/hush-vars/param_expand_len.tests
index fe20a45e9..369c8d456 100755
--- a/shell/hush_test/hush-vars/param_expand_len.tests
+++ b/shell/hush_test/hush-vars/param_expand_len.tests
@@ -15,3 +15,10 @@ unset e
 f=abc
 g=
 echo ${#e} ${#f} ${#g}
+
+set -- a
+# This must be interpreted as: $# ("1"), then remove trailing "1".
+# IOW: empty result.
+echo Nothing:${##1}
+echo Nothing:${#%1}
+echo One:${##x}