diff --git a/bin/sh/parser.c b/bin/sh/parser.c
index c4191b4ea18..43822f934d6 100644
--- a/bin/sh/parser.c
+++ b/bin/sh/parser.c
@@ -1569,6 +1569,8 @@ varname:
 				}
 			}
 		} else if (subtype != VSERROR) {
+			if (subtype == VSLENGTH && c != '}')
+				subtype = VSERROR;
 			pungetc();
 		}
 		STPUTC('=', out);
diff --git a/tools/regression/bin/sh/errors/bad-parm-exp6.2 b/tools/regression/bin/sh/errors/bad-parm-exp6.2
new file mode 100644
index 00000000000..ba51442fb7f
--- /dev/null
+++ b/tools/regression/bin/sh/errors/bad-parm-exp6.2
@@ -0,0 +1,2 @@
+# $FreeBSD$
+${#foo^}
diff --git a/tools/regression/bin/sh/errors/bad-parm-exp6.2.stderr b/tools/regression/bin/sh/errors/bad-parm-exp6.2.stderr
new file mode 100644
index 00000000000..dbf14b596e1
--- /dev/null
+++ b/tools/regression/bin/sh/errors/bad-parm-exp6.2.stderr
@@ -0,0 +1 @@
+./errors/bad-parm-exp6.2: ${foo...}: Bad substitution