diff --git a/NEWS b/NEWS
index a941a4ba2dcb..ab2005d1d62e 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,11 @@ This documents significant changes in the dev branch of ksh 93u+m.
 For full details, see the git log at: https://github.com/ksh93/ksh
 Uppercase BUG_* IDs are shell bug IDs as used by the Modernish shell library.
 
+2024-03-22:
+
+- Fixed a crash in the getconf built-in that could occur after the 'builtin'
+  command was used to bind it to the same path as the external getconf command.
+
 2024-03-20:
 
 - Android with Termux is now a supported environment for ksh 93u+m. Testing
diff --git a/bin/package b/bin/package
index 915634d35341..7b6177c8961a 100755
--- a/bin/package
+++ b/bin/package
@@ -1727,6 +1727,15 @@ DEFPATH=$(
 		$CC $CCFLAGS $LDFLAGS -o "$t.exe" "$t.c" 2>/dev/null && "$t.exe"
 	}
 ) || DEFPATH=/bin:/usr/bin:/sbin:/usr/sbin
+# Fix for Android/Termux. The /bin directory exists with standard
+# utilities (sh, Toybox utils) but it is not included in _PATH_DEFPATH.
+# It should come first because /bin is read-only.
+if	test -d /data/data/com.termux && test "$(/bin/uname -o 2>/dev/null)" = Android
+then	case ":$DEFPATH:" in
+	*:/bin:* ) ;;
+	* )	DEFPATH=/bin:$DEFPATH ;;
+	esac
+fi
 # Fix for NixOS. Not all POSIX standard utilities come with the default system,
 # e.g. 'bc', 'file', 'vi'. The command that NixOS recommends to get missing
 # utilities, e.g. 'nix-env -iA nixos.bc', installs them in a default profile
diff --git a/src/cmd/ksh93/include/version.h b/src/cmd/ksh93/include/version.h
index 81af66d4b9e8..64c7e4aa9f0e 100644
--- a/src/cmd/ksh93/include/version.h
+++ b/src/cmd/ksh93/include/version.h
@@ -18,7 +18,7 @@
 
 #define SH_RELEASE_FORK	"93u+m"		/* only change if you develop a new ksh93 fork */
 #define SH_RELEASE_SVER	"1.1.0-alpha"	/* semantic version number: https://semver.org */
-#define SH_RELEASE_DATE	"2024-03-20"	/* must be in this format for $((.sh.version)) */
+#define SH_RELEASE_DATE	"2024-03-22"	/* must be in this format for $((.sh.version)) */
 #define SH_RELEASE_CPYR	"(c) 2020-2024 Contributors to ksh " SH_RELEASE_FORK
 
 /* Scripts sometimes field-split ${.sh.version}, so don't change amount of whitespace. */
diff --git a/src/cmd/ksh93/tests/path.sh b/src/cmd/ksh93/tests/path.sh
index fdacae0bc7b1..b8e44e42c2ca 100755
--- a/src/cmd/ksh93/tests/path.sh
+++ b/src/cmd/ksh93/tests/path.sh
@@ -318,6 +318,7 @@ if builtin getconf 2> /dev/null; then
 fi
 
 PATH=$path
+builtin -d /bin/getconf
 
 scr=$tmp/script
 exp=126
@@ -1022,5 +1023,19 @@ got=${ whence -t whence_t_test 2>&1; }
 got=${ type -t whence_t_test 2>&1; }
 [[ $got == "$exp" ]] || err_exit "incorrect 'type -t' output for undefined function (expected '$exp', got '$got')"
 
+# ======
+(
+	builtin getconf 2>/dev/null || exit 1
+	p=$(getconf GETCONF)
+	[[ $p == /*/getconf ]] || exit 2
+	builtin -d getconf
+	builtin "$p"
+	PATH=${p%/getconf}
+	getconf some_nonexistent_config_variable  # be sure to trigger fallback to external command
+	exit 0
+) >/dev/null 2>&1
+(((e = $?) > 1)) && err_exit 'getconf builtin fails when on same path as external getconf' \
+	"(got status $e$( ((e>128)) && print -n /SIG && kill -l "$e"))"
+
 # ======
 exit $((Errors<125?Errors:125))
diff --git a/src/lib/libast/port/astconf.c b/src/lib/libast/port/astconf.c
index b9289a103ee5..4780436fc50a 100644
--- a/src/lib/libast/port/astconf.c
+++ b/src/lib/libast/port/astconf.c
@@ -790,9 +790,9 @@ feature(Feature_t* fp, const char* name, const char* path, const char* value, un
 static int
 lookup(Lookup_t* look, const char* name, unsigned int flags)
 {
-	Conf_t*		mid = (Conf_t*)conf;
-	Conf_t*		lo = mid;
-	Conf_t*		hi = mid + conf_elements;
+	Conf_t*		lo = (Conf_t*)conf;
+	Conf_t*		mid = lo;
+	Conf_t*		hi = lo + conf_elements - 1;
 	int		v = 0;
 	int		c;
 	char*		e;
diff --git a/src/lib/libcmd/getconf.c b/src/lib/libcmd/getconf.c
index 44bc93dd623c..460fbc04d311 100644
--- a/src/lib/libcmd/getconf.c
+++ b/src/lib/libcmd/getconf.c
@@ -139,6 +139,7 @@ b_getconf(int argc, char** argv, Shbltin_t* context)
 	int			flags;
 	int			n;
 	char**			oargv;
+	char**			new_argv;
 	static const char	empty[] = "-";
 
 	cmdinit(argc, argv, context, ERROR_CATALOG, 0);
@@ -274,8 +275,12 @@ b_getconf(int argc, char** argv, Shbltin_t* context)
 	/*
 	 * Run the external getconf command
 	 */
-	oargv[0] = native;
-	if ((n = sh_run(context, argc, oargv)) >= EXIT_NOEXEC)
+	new_argv = stkalloc(stkstd, (argc + 3) * sizeof(char*));
+	new_argv[0] = "command";
+	new_argv[1] = "-x";
+	new_argv[2] = native;
+	memcpy(new_argv + 3, oargv + 1, argc * sizeof(char*));
+	if ((n = sh_run(context, argc + 2, new_argv)) >= EXIT_NOEXEC)
 		error(ERROR_SYSTEM|2, "%s: exec error [%d]", native, n);
 	return n;
 }