diff --git a/ext/nokogiri/xml_document.c b/ext/nokogiri/xml_document.c
index c6856f979a..bfaaf94f54 100644
--- a/ext/nokogiri/xml_document.c
+++ b/ext/nokogiri/xml_document.c
@@ -100,13 +100,14 @@ memsize_node(const xmlNodePtr node)
 {
   /* note we don't count namespace definitions, just going for a good-enough number here */
   xmlNodePtr child;
+  xmlAttrPtr property;
   size_t memsize = 0;
 
   memsize += xmlStrlen(node->name);
 
   if (node->type == XML_ELEMENT_NODE) {
-    for (child = (xmlNodePtr)node->properties; child; child = child->next) {
-      memsize += sizeof(xmlAttr) + memsize_node(child);
+    for (property = node->properties; property; property = property->next) {
+      memsize += sizeof(xmlAttr) + memsize_node((xmlNodePtr)property);
     }
   }
   if (node->type == XML_TEXT_NODE) {
diff --git a/test/test_memory_leak.rb b/test/test_memory_leak.rb
index 3b8dc32d1e..14d0889b25 100644
--- a/test/test_memory_leak.rb
+++ b/test/test_memory_leak.rb
@@ -313,6 +313,21 @@ def test_object_space_memsize_of
     assert(bigger_name_size > base_size, "longer tags should increase memsize")
   end
 
+  def test_object_space_memsize_with_dtd
+    # https://github.com/sparklemotion/nokogiri/issues/2923
+    require "objspace"
+    skip("memsize_of not defined") unless ObjectSpace.respond_to?(:memsize_of)
+
+    doc = Nokogiri::XML(<<~XML)
+      <?xml version="1.0"?>
+      <!DOCTYPE staff PUBLIC "staff.dtd" [
+        <!ATTLIST payment type CDATA "check">
+      ]>
+      <staff></staff>
+    XML
+    ObjectSpace.memsize_of(doc) # assert_does_not_crash
+  end
+
   module MemInfo
     # from https://stackoverflow.com/questions/7220896/get-current-ruby-process-memory-usage
     # this is only going to work on linux