diff --git a/Makefile b/Makefile
index f1caf38..baab853 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-# $MirOS: src/bin/mksh/Makefile,v 1.89 2011/11/25 23:29:30 tg Exp $
+# $MirOS: src/bin/mksh/Makefile,v 1.90 2011/11/26 00:45:17 tg Exp $
 #-
 # Copyright (c) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011
 #	Thorsten Glaser <tg@mirbsd.org>
@@ -70,7 +70,7 @@ regress: ${PROG} check.pl check.t
 	mkdir -p regress-dir
 	echo export FNORD=666 >regress-dir/.mkshrc
 	HOME=$$(realpath regress-dir) perl ${.CURDIR}/check.pl \
-	    -s ${.CURDIR}/check.t -v -p ./${PROG}
+	    -s ${.CURDIR}/check.t -v -p ./${PROG} -C fastbox
 
 test-build: .PHONY
 	-rm -rf build-dir
diff --git a/check.t b/check.t
index 6d85e61..3e12489 100644
--- a/check.t
+++ b/check.t
@@ -1,4 +1,4 @@
-# $MirOS: src/bin/mksh/check.t,v 1.495 2011/11/25 23:33:42 tg Exp $
+# $MirOS: src/bin/mksh/check.t,v 1.496 2011/11/26 00:45:18 tg Exp $
 # $OpenBSD: bksl-nl.t,v 1.2 2001/01/28 23:04:56 niklas Exp $
 # $OpenBSD: history.t,v 1.5 2001/01/28 23:04:56 niklas Exp $
 # $OpenBSD: read.t,v 1.3 2003/03/10 03:48:16 david Exp $
@@ -25,7 +25,7 @@
 # http://www.research.att.com/~gsf/public/ifs.sh
 
 expected-stdout:
-	@(#)MIRBSD KSH R40 2011/11/21
+	@(#)MIRBSD KSH R40 2011/11/25
 description:
 	Check version of shell.
 stdin:
@@ -9603,10 +9603,9 @@ expected-stdout:
 	b
 	x
 ---
-name: alloc-overflow-1
+name: stateptr-underflow
 description:
-	This check overflows mksh R40 memory allocation
-	unless 't=$t' is changed to 't+='
+	This check overflows an Xrestpos stored in a short in R40
 category: fastbox
 stdin:
 	function Lb64decode {
diff --git a/eval.c b/eval.c
index 49e5e6e..fe8dea7 100644
--- a/eval.c
+++ b/eval.c
@@ -22,7 +22,7 @@
 
 #include "sh.h"
 
-__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.109 2011/10/11 19:06:07 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/eval.c,v 1.110 2011/11/26 00:45:20 tg Exp $");
 
 /*
  * string expansion
@@ -189,8 +189,8 @@ typedef struct SubType {
 	struct tbl *var;	/* variable for ${var..} */
 	struct SubType *prev;	/* old type */
 	struct SubType *next;	/* poped type (to avoid re-allocating) */
+	size_t	base;		/* begin position of expanded word */
 	short	stype;		/* [=+-?%#] action after expanded word */
-	short	base;		/* begin position of expanded word */
 	short	f;		/* saved value of f (DOPAT, etc) */
 	uint8_t	quotep;		/* saved value of quote (for ${..[%#]..}) */
 	uint8_t	quotew;		/* saved value of quote (for ${..[+-=]..}) */
diff --git a/sh.h b/sh.h
index a8acf6b..60d78c1 100644
--- a/sh.h
+++ b/sh.h
@@ -151,9 +151,9 @@
 #endif
 
 #ifdef EXTERN
-__RCSID("$MirOS: src/bin/mksh/sh.h,v 1.504 2011/11/22 18:01:40 tg Exp $");
+__RCSID("$MirOS: src/bin/mksh/sh.h,v 1.505 2011/11/26 00:45:21 tg Exp $");
 #endif
-#define MKSH_VERSION "R40 2011/11/21"
+#define MKSH_VERSION "R40 2011/11/25"
 
 #ifndef MKSH_INCLUDES_ONLY