diff --git a/libraries/liblmdb/CHANGES b/libraries/liblmdb/CHANGES
index 857a08e14c..0606e5d537 100644
--- a/libraries/liblmdb/CHANGES
+++ b/libraries/liblmdb/CHANGES
@@ -1,12 +1,14 @@
 LMDB 0.9 Change Log
 
 LMDB 0.9.34 Engineering
+	ITS#9564 - fix race condition freeing spilled pages at end of transaction
 	ITS#10222 - Update mdb_dump(1) and mdb_load(1) man pages for append (-a) option
 	ITS#10275 - mdb_load: add -Q option to use NOSYNC
 	ITS#10296 - fix fdatasync on MacOS
 	ITS#10342 - fix memleak in mdb_txn_begin for nested txns
 	ITS#10346 - fix mdb_env_copy2 with values > (2GB-16)
 	ITS#10355 - fix mplay build on musl
+	ITS#10396 - fix mdb_cursor_del0 with multiple DUPSORT cursors
 
 LMDB 0.9.33 Release (2024/05/21)
 	ITS#9037 mdb_page_search: fix error code when DBI record is missing
diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
index 7a52945c3b..a6b5375c00 100644
--- a/libraries/liblmdb/mdb.c
+++ b/libraries/liblmdb/mdb.c
@@ -3078,6 +3078,7 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
 
 		txn->mt_numdbs = 0;
 		txn->mt_flags = MDB_TXN_FINISHED;
+		mdb_midl_free(txn->mt_spill_pgs);
 
 		if (!txn->mt_parent) {
 			mdb_midl_shrink(&txn->mt_free_pgs);
@@ -3099,7 +3100,6 @@ mdb_txn_end(MDB_txn *txn, unsigned mode)
 			mdb_midl_free(txn->mt_free_pgs);
 			free(txn->mt_u.dirty_list);
 		}
-		mdb_midl_free(txn->mt_spill_pgs);
 
 		mdb_midl_free(pghead);
 	}
@@ -8608,7 +8608,7 @@ mdb_cursor_del0(MDB_cursor *mc)
 						goto fail;
 				}
 				if (m3->mc_xcursor && !(m3->mc_flags & C_EOF)) {
-					MDB_node *node = NODEPTR(m3->mc_pg[m3->mc_top], m3->mc_ki[m3->mc_top]);
+					MDB_node *node = NODEPTR(m3->mc_pg[mc->mc_top], m3->mc_ki[mc->mc_top]);
 					/* If this node has dupdata, it may need to be reinited
 					 * because its data has moved.
 					 * If the xcursor was not initd it must be reinited.