diff --git a/src/cmd/ksh93/sh/subshell.c b/src/cmd/ksh93/sh/subshell.c
index fdb020729036..cd98deb046e5 100644
--- a/src/cmd/ksh93/sh/subshell.c
+++ b/src/cmd/ksh93/sh/subshell.c
@@ -571,7 +571,6 @@ Sfio_t *sh_subshell(Shell_t *shp,Shnode_t *t, volatile int flags, int comsub)
 		shp->st.otrap = savst.trap;
 		if((nsig=shp->st.trapmax)>0 || shp->st.trapcom[0])
 		{
-			++nsig;
 			savsig = malloc(nsig * sizeof(char*));
 			/*
 			 * the data is, usually, modified in code like:
diff --git a/src/cmd/ksh93/sh/xec.c b/src/cmd/ksh93/sh/xec.c
index e5b460abc12d..7abafe4b5bfa 100644
--- a/src/cmd/ksh93/sh/xec.c
+++ b/src/cmd/ksh93/sh/xec.c
@@ -3096,7 +3096,6 @@ int sh_funscope(int argn, char *argv[],int(*fun)(void*),void *arg,int execflg)
 	/* save trap table */
 	if((nsig=shp->st.trapmax)>0 || shp->st.trapcom[0])
 	{
-		++nsig;
 		savsig = malloc(nsig * sizeof(char*));
 		/*
 		 * the data is, usually, modified in code like:
diff --git a/src/cmd/ksh93/tests/signal.sh b/src/cmd/ksh93/tests/signal.sh
index 1bec29701530..c69e798abf29 100755
--- a/src/cmd/ksh93/tests/signal.sh
+++ b/src/cmd/ksh93/tests/signal.sh
@@ -480,5 +480,19 @@ then
 	kill -INFO $$ || err_exit '`kill` cannot send SIGINFO to processes when passed `-INFO`'
 fi
 
+# ======
+# Due to an off-by-one error, the last signal in 'kill -l' output wasn't treated properly and could crash.
+
+sig=$(kill -l | tail -n 1)
+exp="OK: $sig"
+
+got=$(export sig; "$SHELL" -c '
+	trap "print '\''OK: $sig'\''" "$sig"
+	(kill -s "$sig" "$$")
+	trap - "$sig"
+' 2>&1)
+((!(e = $?))) && [[ $got == "$exp" ]] || err_exit "failed to handle SIG$sig from subshell" \
+	"(got status $e$( ((e>128)) && print -n / && kill -l "$e"), $(printf %q "$got"))"
+
 # ======
 exit $((Errors<125?Errors:125))