diff --git a/shell/ash_test/ash-vars/var6.right b/shell/ash_test/ash-vars/var6.right
new file mode 100644
index 000000000..b37417fa1
--- /dev/null
+++ b/shell/ash_test/ash-vars/var6.right
@@ -0,0 +1,2 @@
+SHELL: line 1: syntax error: bad substitution
+SHELL: line 1: syntax error: bad substitution
diff --git a/shell/ash_test/ash-vars/var6.tests b/shell/ash_test/ash-vars/var6.tests
new file mode 100755
index 000000000..626e60ee1
--- /dev/null
+++ b/shell/ash_test/ash-vars/var6.tests
@@ -0,0 +1,5 @@
+# reject invalid vars
+# (set argv0 to "SHELL" to avoid "/path/to/shell: blah" in error messages)
+"$THIS_SH" -c 'echo ${1q}' SHELL
+"$THIS_SH" -c 'echo ${&}' SHELL
+#"$THIS_SH" -c 'echo ${$}' SHELL -- this is valid as it's the same as $$
diff --git a/shell/ash_test/ash-vars/var_nested1.right b/shell/ash_test/ash-vars/var_nested1.right
new file mode 100644
index 000000000..f4bc5f4b6
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_nested1.right
@@ -0,0 +1,3 @@
+Expected:AB Actual:AB
+Expected:Ab Actual:Ab
+Expected:ab Actual:ab
diff --git a/shell/ash_test/ash-vars/var_nested1.tests b/shell/ash_test/ash-vars/var_nested1.tests
new file mode 100755
index 000000000..59e4a14fa
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_nested1.tests
@@ -0,0 +1,16 @@
+f() { a=A; b=B; }
+
+a=a
+b=b
+f
+echo Expected:AB Actual:$a$b
+
+a=a
+b=b
+b= f
+echo Expected:Ab Actual:$a$b
+
+a=a
+b=b
+a= b= f
+echo Expected:ab Actual:$a$b
diff --git a/shell/ash_test/ash-vars/var_nested2.right b/shell/ash_test/ash-vars/var_nested2.right
new file mode 100644
index 000000000..c930d971c
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_nested2.right
@@ -0,0 +1 @@
+aB
diff --git a/shell/ash_test/ash-vars/var_nested2.tests b/shell/ash_test/ash-vars/var_nested2.tests
new file mode 100755
index 000000000..e8865861e
--- /dev/null
+++ b/shell/ash_test/ash-vars/var_nested2.tests
@@ -0,0 +1,2 @@
+# the bug was easier to trigger in one-liner form
+a=a; b=b; f() { a=A; b=B; }; a= f; echo $a$b
diff --git a/shell/hush_test/hush-vars/var6.tests b/shell/hush_test/hush-vars/var6.tests
index aea36d62d..626e60ee1 100755
--- a/shell/hush_test/hush-vars/var6.tests
+++ b/shell/hush_test/hush-vars/var6.tests
@@ -1,4 +1,5 @@
 # reject invalid vars
-"$THIS_SH" -c 'echo ${1q}'
-"$THIS_SH" -c 'echo ${&}'
-#"$THIS_SH" -c 'echo ${$}' -- this is valid as it's the same as $$
+# (set argv0 to "SHELL" to avoid "/path/to/shell: blah" in error messages)
+"$THIS_SH" -c 'echo ${1q}' SHELL
+"$THIS_SH" -c 'echo ${&}' SHELL
+#"$THIS_SH" -c 'echo ${$}' SHELL -- this is valid as it's the same as $$