Index: trunk/src/kash/shinstance.c
===================================================================
--- trunk/src/kash/shinstance.c	(revision 3568)
+++ trunk/src/kash/shinstance.c	(revision 3569)
@@ -489,5 +489,5 @@
         {
             struct localvar *next = lvar->next;
-			if (!(lvar->flags & VTEXTFIXED))
+            if (!(lvar->flags & VTEXTFIXED))
                 sh_free(psh, lvar->text);
             sh_free(psh, lvar);
@@ -509,5 +509,5 @@
                 if (!(var->flags & (VTEXTFIXED | VSTACK)))
                     sh_free(psh, var->text);
-                if (!(var->flags & VSTRFIXED))
+                if (!(var->flags & (VSTRFIXED | VSTRFIXED2)))
                     sh_free(psh, var);
                 var = next;
Index: trunk/src/kash/var.c
===================================================================
--- trunk/src/kash/var.c	(revision 3568)
+++ trunk/src/kash/var.c	(revision 3569)
@@ -137,31 +137,31 @@
 const struct varinit varinit[] = {
 #if ATTY
-	{ offsetof(shinstance, vatty),	VSTRFIXED|VTEXTFIXED|VUNSET,	"ATTY=",
+	{ offsetof(shinstance, vatty),	VSTRFIXED|VSTRFIXED2|VTEXTFIXED|VUNSET,	"ATTY=",
 	  NULL },
 #endif
 #ifndef SMALL
-	{ offsetof(shinstance, vhistsize),	VSTRFIXED|VTEXTFIXED|VUNSET,	"HISTSIZE=",
+	{ offsetof(shinstance, vhistsize),	VSTRFIXED|VSTRFIXED2|VTEXTFIXED|VUNSET,	"HISTSIZE=",
 	  sethistsize },
 #endif
-	{ offsetof(shinstance, vifs),	VSTRFIXED|VTEXTFIXED,		"IFS= \t\n",
+	{ offsetof(shinstance, vifs),	VSTRFIXED|VSTRFIXED2|VTEXTFIXED,		"IFS= \t\n",
 	  NULL },
-	{ offsetof(shinstance, vmail),	VSTRFIXED|VTEXTFIXED|VUNSET,	"MAIL=",
+	{ offsetof(shinstance, vmail),	VSTRFIXED|VSTRFIXED2|VTEXTFIXED|VUNSET,	"MAIL=",
 	  NULL },
-	{ offsetof(shinstance, vmpath),	VSTRFIXED|VTEXTFIXED|VUNSET,	"MAILPATH=",
+	{ offsetof(shinstance, vmpath),	VSTRFIXED|VSTRFIXED2|VTEXTFIXED|VUNSET,	"MAILPATH=",
 	  NULL },
-	{ offsetof(shinstance, vpath),	VSTRFIXED|VTEXTFIXED,		"PATH=" _PATH_DEFPATH,
+	{ offsetof(shinstance, vpath),	VSTRFIXED|VSTRFIXED2|VTEXTFIXED,		"PATH=" _PATH_DEFPATH,
 	  changepath },
 	/*
 	 * vps1 depends on uid
 	 */
-	{ offsetof(shinstance, vps2),	VSTRFIXED|VTEXTFIXED,		"PS2=> ",
+	{ offsetof(shinstance, vps2),	VSTRFIXED|VSTRFIXED2|VTEXTFIXED,		"PS2=> ",
 	  NULL },
-	{ offsetof(shinstance, vps4),	VSTRFIXED|VTEXTFIXED,		"PS4=+ ",
+	{ offsetof(shinstance, vps4),	VSTRFIXED|VSTRFIXED2|VTEXTFIXED,		"PS4=+ ",
 	  NULL },
 #ifndef SMALL
-	{ offsetof(shinstance, vterm),	VSTRFIXED|VTEXTFIXED|VUNSET,	"TERM=",
+	{ offsetof(shinstance, vterm),	VSTRFIXED|VSTRFIXED2|VTEXTFIXED|VUNSET,	"TERM=",
 	  setterm },
 #endif
-	{ offsetof(shinstance, voptind),	VSTRFIXED|VTEXTFIXED|VNOFUNC,	"OPTIND=1",
+	{ offsetof(shinstance, voptind),	VSTRFIXED|VSTRFIXED2|VTEXTFIXED|VNOFUNC,	"OPTIND=1",
 	  getoptsreset },
 	{ 0,	0,				NULL,
@@ -212,5 +212,5 @@
 	for (i = 0; i < 4; i++)
 	{
-		psh->libpath_vars[i].flags = VSTRFIXED | VOS2LIBPATH;
+		psh->libpath_vars[i].flags = VSTRFIXED | VSTRFIXED2 | VOS2LIBPATH;
 		psh->libpath_vars[i].func = NULL;
 
@@ -236,5 +236,5 @@
 		{
 			psh->libpath_vars[i].flags |= VUNSET | VTEXTFIXED;
-			psh->libpath_vars[i].text = (char*)libpath_envs[i];
+			psh->libpath_vars[i].text = (char *)libpath_envs[i];
 		}
 		if (find_var(psh, psh->libpath_vars[i].text, &vpp, &psh->libpath_vars[i].name_len) != NULL)
@@ -267,5 +267,5 @@
 		psh->vps1.text = sh_strdup(psh, sh_geteuid(psh) ? "PS1=$ " : "PS1=# ");
 #endif
-		psh->vps1.flags = VSTRFIXED|VTEXTFIXED;
+		psh->vps1.flags = VSTRFIXED|VSTRFIXED2|VTEXTFIXED; /** @todo text isn't fixed here... */
 	}
 }
@@ -282,14 +282,15 @@
 	for (i = 0; i < K_ELEMENTS(inherit->vartab); i++) {
 		struct var const *vsrc = inherit->vartab[i];
-		if (!vsrc) {
-		} else {
+		if (vsrc) {
 			struct var **ppdst = &psh->vartab[i];
 			do
 			{
 				struct var *dst;
-				if (!(vsrc->flags & VSTRFIXED)) {
+				if (!(vsrc->flags & VSTRFIXED2)) {
 					dst = (struct var *)ckmalloc(psh, sizeof(*dst));
+					*dst = *vsrc;
+					dst->flags &= ~VSTRFIXED;
 				} else {
-					/* VSTRFIXED is used when the structure is a fixed allocation in
+					/* VSTRFIXED2 is used when the structure is a fixed allocation in
 					   the shinstance structure, so scan those to find which it is: */
 					size_t            left     = ((struct var *)&inherit->vartab[0] - &inherit->vatty);
@@ -303,6 +304,6 @@
 							break;
 					kHlpAssert(left < 256 /*whatever, just no rollover*/);
+					*dst = *vsrc;
 				}
-				*dst = *vsrc;
 
 				if (!(vsrc->flags & VTEXTFIXED)) {
@@ -328,10 +329,12 @@
 			struct localvar *dst = ckmalloc(psh, sizeof(*dst));
 
-			dst->flags = vsrc->flags & ~VSTACK;
-			if (vsrc->flags & VTEXTFIXED)
-				dst->text = savestr(psh, vsrc->text);
+			dst->flags = vsrc->flags & ~(VSTACK | VTEXTFIXED | (vsrc->flags & VSTRFIXED2 ? 0 : VSTRFIXED));
+			if (vsrc->text)
+			    dst->text = savestr(psh, vsrc->text);
 			else
-				dst->text = vsrc->text;
-
+			{
+			    dst->text = NULL;
+			    dst->flags |= vsrc->flags & VTEXTFIXED;
+			}
 			dst->vp = find_var(psh, vsrc->vp->text, NULL, NULL);
 			kHlpAssert(dst->vp);
@@ -342,4 +345,5 @@
 			vsrc = vsrc->next;
 		} while (vsrc);
+		*ppdst = NULL;
 	}
 }
@@ -630,5 +634,5 @@
 				if ((vp->flags & VTEXTFIXED) == 0)
 					ckfree(psh, vp->text);
-				if ((vp->flags & VSTRFIXED) == 0)
+				if ((vp->flags & (VSTRFIXED | VSTRFIXED2)) == 0)
 					ckfree(psh, vp);
 			} else {
@@ -948,5 +952,5 @@
 		vp->flags &= ~VEXPORT;
 		vp->flags |= VUNSET;
-		if ((vp->flags & VSTRFIXED) == 0) {
+		if ((vp->flags & (VSTRFIXED | VSTRFIXED2)) == 0) {
 			if ((vp->flags & VTEXTFIXED) == 0)
 				ckfree(psh, vp->text);
Index: trunk/src/kash/var.h
===================================================================
--- trunk/src/kash/var.h	(revision 3568)
+++ trunk/src/kash/var.h	(revision 3569)
@@ -51,4 +51,5 @@
 #define VNOFUNC		0x40	/* don't call the callback function */
 #define VNOSET		0x80	/* do not set variable - just readonly test */
+#define VSTRFIXED2      0x4000  /* variable struct is in the shinstance, cannot be freed. (VSTRFIXED is mixed up in local vars) */
 #ifdef PC_OS2_LIBPATHS
 #define VOS2LIBPATH     0x8000  /* OS/2 LIBPATH related variable. */
