diff --git a/shell/ash_test/ash-quoting/bkslash_in_varexp.tests b/shell/ash_test/ash-quoting/bkslash_in_varexp.tests
index 41b31ab54..6c7b4b0cc 100755
--- a/shell/ash_test/ash-quoting/bkslash_in_varexp.tests
+++ b/shell/ash_test/ash-quoting/bkslash_in_varexp.tests
@@ -1,4 +1,14 @@
-x=a
+x='a]'
+#
+# \] is not a valid escape for ] in set glob expression.
+# Glob sets have no escaping at all:
+# ] can be in a set if it is the first char: []abc],
+# dash can be in a set if it is first or last: [abc-],
+# [ and \ need no protections at all: [a[b\c] is a valid set of 5 chars.
+#
+# bash-4.3.43 misinterprets [a\]] as "set of 'a' or ']'".
+# Correct interpretation is "set of 'a' or '\', followed by ']'".
+#
 echo Nothing:${x#[a\]]}
 echo Nothing:"${x#[a\]]}"
 echo Nothing:${x%[a\]]}
diff --git a/shell/ash_test/ash-quoting/bkslash_in_varexp1.right b/shell/ash_test/ash-quoting/bkslash_in_varexp1.right
new file mode 100644
index 000000000..d03047024
--- /dev/null
+++ b/shell/ash_test/ash-quoting/bkslash_in_varexp1.right
@@ -0,0 +1,5 @@
+Nothing:
+Nothing:
+Nothing:
+Nothing:
+Ok:0
diff --git a/shell/ash_test/ash-quoting/bkslash_in_varexp1.tests b/shell/ash_test/ash-quoting/bkslash_in_varexp1.tests
new file mode 100755
index 000000000..3c817eae1
--- /dev/null
+++ b/shell/ash_test/ash-quoting/bkslash_in_varexp1.tests
@@ -0,0 +1,6 @@
+x=a
+echo Nothing:${x#[]a]}
+echo Nothing:"${x#[]a]}"
+echo Nothing:${x%[]a]}
+echo Nothing:"${x%[]a]}"
+echo Ok:$?
diff --git a/shell/hush.c b/shell/hush.c
index e005b0a20..da4967a8a 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -4488,7 +4488,7 @@ static int add_till_closing_bracket(o_string *dest, struct in_str *input, unsign
 		}
 		if (ch == end_ch
 # if BASH_SUBSTR || BASH_PATTERN_SUBST
-			|| ch == end_char2
+		 || ch == end_char2
 # endif
 		) {
 			if (!dbl)
@@ -5842,17 +5842,18 @@ static NOINLINE const char *expand_one_var(char **to_be_freed_pp, char *arg, cha
 				unsigned scan_flags = pick_scan(exp_op, *exp_word);
 				if (exp_op == *exp_word)  /* ## or %% */
 					exp_word++;
+				debug_printf_expand("expand: exp_word:'%s'\n", exp_word);
 				exp_exp_word = encode_then_expand_string(exp_word, /*process_bkslash:*/ 1, /*unbackslash:*/ 1);
 				if (exp_exp_word)
 					exp_word = exp_exp_word;
+				debug_printf_expand("expand: exp_exp_word:'%s'\n", exp_word);
 				/* HACK ALERT. We depend here on the fact that
 				 * G.global_argv and results of utoa and get_local_var_value
 				 * are actually in writable memory:
 				 * scan_and_match momentarily stores NULs there. */
 				t = (char*)val;
 				loc = scan_and_match(t, exp_word, scan_flags);
-				//bb_error_msg("op:%c str:'%s' pat:'%s' res:'%s'",
-				//		exp_op, t, exp_word, loc);
+				debug_printf_expand("op:%c str:'%s' pat:'%s' res:'%s'\n", exp_op, t, exp_word, loc);
 				free(exp_exp_word);
 				if (loc) { /* match was found */
 					if (scan_flags & SCAN_MATCH_LEFT_HALF) /* #[#] */
diff --git a/shell/hush_test/hush-quoting/bkslash_in_varexp.tests b/shell/hush_test/hush-quoting/bkslash_in_varexp.tests
index 41b31ab54..6c7b4b0cc 100755
--- a/shell/hush_test/hush-quoting/bkslash_in_varexp.tests
+++ b/shell/hush_test/hush-quoting/bkslash_in_varexp.tests
@@ -1,4 +1,14 @@
-x=a
+x='a]'
+#
+# \] is not a valid escape for ] in set glob expression.
+# Glob sets have no escaping at all:
+# ] can be in a set if it is the first char: []abc],
+# dash can be in a set if it is first or last: [abc-],
+# [ and \ need no protections at all: [a[b\c] is a valid set of 5 chars.
+#
+# bash-4.3.43 misinterprets [a\]] as "set of 'a' or ']'".
+# Correct interpretation is "set of 'a' or '\', followed by ']'".
+#
 echo Nothing:${x#[a\]]}
 echo Nothing:"${x#[a\]]}"
 echo Nothing:${x%[a\]]}
diff --git a/shell/hush_test/hush-quoting/bkslash_in_varexp1.right b/shell/hush_test/hush-quoting/bkslash_in_varexp1.right
new file mode 100644
index 000000000..d03047024
--- /dev/null
+++ b/shell/hush_test/hush-quoting/bkslash_in_varexp1.right
@@ -0,0 +1,5 @@
+Nothing:
+Nothing:
+Nothing:
+Nothing:
+Ok:0
diff --git a/shell/hush_test/hush-quoting/bkslash_in_varexp1.tests b/shell/hush_test/hush-quoting/bkslash_in_varexp1.tests
new file mode 100755
index 000000000..3c817eae1
--- /dev/null
+++ b/shell/hush_test/hush-quoting/bkslash_in_varexp1.tests
@@ -0,0 +1,6 @@
+x=a
+echo Nothing:${x#[]a]}
+echo Nothing:"${x#[]a]}"
+echo Nothing:${x%[]a]}
+echo Nothing:"${x%[]a]}"
+echo Ok:$?
diff --git a/shell/match.c b/shell/match.c
index fee3cf2a8..8f2a2fb38 100644
--- a/shell/match.c
+++ b/shell/match.c
@@ -71,9 +71,11 @@ char* FAST_FUNC scan_and_match(char *string, const char *pattern, unsigned flags
 		if (flags & SCAN_MATCH_LEFT_HALF) {
 			*loc = '\0';
 			r = fnmatch(pattern, string, 0);
+			//bb_error_msg("fnmatch('%s','%s',0):%d", pattern, string, r);
 			*loc = c;
 		} else {
 			r = fnmatch(pattern, loc, 0);
+			//bb_error_msg("fnmatch('%s','%s',0):%d", pattern, string, r);
 		}
 		if (r == 0) /* match found */
 			return loc;