diff --git a/bin/sh/eval.c b/bin/sh/eval.c
index e09549295f6..f637cfab5fd 100644
--- a/bin/sh/eval.c
+++ b/bin/sh/eval.c
@@ -1080,8 +1080,8 @@ evalcommand(union node *cmd, int flags, struct backcmd *backcmd)
 #endif
 		mode = (cmdentry.u.index == EXECCMD)? 0 : REDIR_PUSH;
 		if (flags == EV_BACKCMD) {
-			memout.nleft = 0;
 			memout.nextc = memout.buf;
+			memout.bufend = memout.buf;
 			memout.bufsize = 64;
 			mode |= REDIR_BACKQ;
 		}
@@ -1134,8 +1134,11 @@ cmddone:
 			exitshell(exitstatus);
 		if (flags == EV_BACKCMD) {
 			backcmd->buf = memout.buf;
-			backcmd->nleft = memout.nextc - memout.buf;
+			backcmd->nleft = memout.buf != NULL ?
+			    memout.nextc - memout.buf : 0;
 			memout.buf = NULL;
+			memout.nextc = NULL;
+			memout.bufend = NULL;
 		}
 		if (cmdentry.u.index != EXECCMD)
 			popredir();
diff --git a/bin/sh/output.c b/bin/sh/output.c
index 2f9fc925d88..64d311f0c2d 100644
--- a/bin/sh/output.c
+++ b/bin/sh/output.c
@@ -71,9 +71,9 @@ __FBSDID("$FreeBSD$");
 
 static int doformat_wr(void *, const char *, int);
 
-struct output output = {NULL, 0, NULL, OUTBUFSIZ, 1, 0};
-struct output errout = {NULL, 0, NULL, 256, 2, 0};
-struct output memout = {NULL, 0, NULL, 0, MEM_OUT, 0};
+struct output output = {NULL, NULL, NULL, OUTBUFSIZ, 1, 0};
+struct output errout = {NULL, NULL, NULL, 256, 2, 0};
+struct output memout = {NULL, NULL, NULL, 0, MEM_OUT, 0};
 struct output *out1 = &output;
 struct output *out2 = &errout;
 
@@ -214,20 +214,19 @@ emptyoutbuf(struct output *dest)
 		INTOFF;
 		dest->buf = ckmalloc(dest->bufsize);
 		dest->nextc = dest->buf;
-		dest->nleft = dest->bufsize;
+		dest->bufend = dest->buf + dest->bufsize;
 		INTON;
 	} else if (dest->fd == MEM_OUT) {
-		offset = dest->bufsize;
+		offset = dest->nextc - dest->buf;
 		INTOFF;
 		dest->bufsize <<= 1;
 		dest->buf = ckrealloc(dest->buf, dest->bufsize);
-		dest->nleft = dest->bufsize - offset;
+		dest->bufend = dest->buf + dest->bufsize;
 		dest->nextc = dest->buf + offset;
 		INTON;
 	} else {
 		flushout(dest);
 	}
-	dest->nleft--;
 }
 
 
@@ -248,7 +247,6 @@ flushout(struct output *dest)
 	if (xwrite(dest->fd, dest->buf, dest->nextc - dest->buf) < 0)
 		dest->flags |= OUTPUT_ERR;
 	dest->nextc = dest->buf;
-	dest->nleft = dest->bufsize;
 }
 
 
@@ -258,8 +256,9 @@ freestdout(void)
 	INTOFF;
 	if (output.buf) {
 		ckfree(output.buf);
+		output.nextc = NULL;
 		output.buf = NULL;
-		output.nleft = 0;
+		output.bufend = NULL;
 	}
 	INTON;
 }
diff --git a/bin/sh/output.h b/bin/sh/output.h
index 21cbba1efa5..f43a60cc2aa 100644
--- a/bin/sh/output.h
+++ b/bin/sh/output.h
@@ -40,7 +40,7 @@
 
 struct output {
 	char *nextc;
-	int nleft;
+	char *bufend;
 	char *buf;
 	int bufsize;
 	short fd;
@@ -75,7 +75,7 @@ void fmtstr(char *, int, const char *, ...) __printflike(3, 4);
 void doformat(struct output *, const char *, va_list) __printflike(2, 0);
 int xwrite(int, const char *, int);
 
-#define outc(c, file)	(--(file)->nleft < 0? (emptyoutbuf(file), *(file)->nextc++ = (c)) : (*(file)->nextc++ = (c)))
+#define outc(c, file)	((file)->nextc == (file)->bufend ? (emptyoutbuf(file), *(file)->nextc++ = (c)) : (*(file)->nextc++ = (c)))
 #define out1c(c)	outc(c, out1);
 #define out2c(c)	outcslow(c, out2);