diff --git a/shell/ash.c b/shell/ash.c
index 5c431c9ff..6cda7251e 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -9600,9 +9600,7 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
 	shellparam.optind = 1;
 	shellparam.optoff = -1;
 #endif
-	pushlocalvars();
 	evaltree(func->n.ndefun.body, flags & EV_TESTED);
-	poplocalvars(0);
  funcdone:
 	INT_OFF;
 	funcline = savefuncline;
@@ -10235,7 +10233,6 @@ evalcommand(union node *cmd, int flags)
 		goto readstatus;
 
 	case CMDFUNCTION:
-		poplocalvars(1);
 		/* See above for the rationale */
 		dowait(DOWAIT_NONBLOCK, NULL);
 		if (evalfun(cmdentry.u.func, argc, argv, flags))
diff --git a/shell/ash_test/ash-misc/env_and_func.right b/shell/ash_test/ash-misc/env_and_func.right
index 5fc3488ae..4a1545058 100644
--- a/shell/ash_test/ash-misc/env_and_func.right
+++ b/shell/ash_test/ash-misc/env_and_func.right
@@ -1,2 +1,2 @@
 var=val
-var=val
+var=old
diff --git a/shell/ash_test/ash-misc/env_and_func.tests b/shell/ash_test/ash-misc/env_and_func.tests
index 3efef1a41..1c63eafd8 100755
--- a/shell/ash_test/ash-misc/env_and_func.tests
+++ b/shell/ash_test/ash-misc/env_and_func.tests
@@ -3,6 +3,6 @@ f() { echo "var=$var"; }
 # bash: POSIXLY_CORRECT behavior is to "leak" new variable values
 # out of function invocations (similar to "special builtins" behavior);
 # but in "bash mode", they don't leak.
-# hush does not "leak" values. ash does.
+# hush does not "leak" values. ash used to, but now does not.
 var=val f
 echo "var=$var"
diff --git a/shell/ash_test/ash-vars/var_leak.right b/shell/ash_test/ash-vars/var_leak.right
index 01a5e3263..764680086 100644
--- a/shell/ash_test/ash-vars/var_leak.right
+++ b/shell/ash_test/ash-vars/var_leak.right
@@ -1,4 +1,4 @@
 should be empty: ''
 should be empty: ''
 should be not empty: 'val2'
-should be not empty: 'val3'
+should be empty: ''
diff --git a/shell/ash_test/ash-vars/var_leak.tests b/shell/ash_test/ash-vars/var_leak.tests
index 5242e24eb..adf66692e 100755
--- a/shell/ash_test/ash-vars/var_leak.tests
+++ b/shell/ash_test/ash-vars/var_leak.tests
@@ -15,9 +15,7 @@ VAR=''
 VAR=val2 exec 2>&1
 echo "should be not empty: '$VAR'"
 
-# ash follows the "function call is a special builtin" rule here
-# (bash does not do it)
 f() { true; }
 VAR=''
 VAR=val3 f
-echo "should be not empty: '$VAR'"
+echo "should be empty: '$VAR'"
diff --git a/shell/hush_test/hush-misc/env_and_func.tests b/shell/hush_test/hush-misc/env_and_func.tests
index 3efef1a41..1c63eafd8 100755
--- a/shell/hush_test/hush-misc/env_and_func.tests
+++ b/shell/hush_test/hush-misc/env_and_func.tests
@@ -3,6 +3,6 @@ f() { echo "var=$var"; }
 # bash: POSIXLY_CORRECT behavior is to "leak" new variable values
 # out of function invocations (similar to "special builtins" behavior);
 # but in "bash mode", they don't leak.
-# hush does not "leak" values. ash does.
+# hush does not "leak" values. ash used to, but now does not.
 var=val f
 echo "var=$var"