diff --git a/shell/ash.c b/shell/ash.c
index c5ad96909..0f9f73ec3 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -10556,7 +10556,7 @@ static union node *andor(void);
 static union node *pipeline(void);
 static union node *parse_command(void);
 static void parseheredoc(void);
-static char peektoken(void);
+static char nexttoken_ends_list(void);
 static int readtoken(void);
 
 static union node *
@@ -10566,7 +10566,7 @@ list(int nlflag)
 	int tok;
 
 	checkkwd = CHKNL | CHKKWD | CHKALIAS;
-	if (nlflag == 2 && peektoken())
+	if (nlflag == 2 && nexttoken_ends_list())
 		return NULL;
 	n1 = NULL;
 	for (;;) {
@@ -10608,8 +10608,15 @@ list(int nlflag)
 				tokpushback = 1;
 			}
 			checkkwd = CHKNL | CHKKWD | CHKALIAS;
-			if (peektoken())
+			if (nexttoken_ends_list()) {
+				/* Testcase: "<<EOF; then <W".
+				 * It used to segfault w/o this check:
+				 */
+				if (heredoclist) {
+					raise_error_unexpected_syntax(-1);
+				}
 				return n1;
+			}
 			break;
 		case TEOF:
 			if (heredoclist)
@@ -12046,7 +12053,7 @@ readtoken(void)
 }
 
 static char
-peektoken(void)
+nexttoken_ends_list(void)
 {
 	int t;
 
diff --git a/shell/ash_test/ash-heredoc/heredoc1.right b/shell/ash_test/ash-heredoc/heredoc1.right
new file mode 100644
index 000000000..895f5ee80
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc1.right
@@ -0,0 +1 @@
+heredoc1.tests: line 3: syntax error: unexpected "then"
diff --git a/shell/ash_test/ash-heredoc/heredoc1.tests b/shell/ash_test/ash-heredoc/heredoc1.tests
new file mode 100755
index 000000000..a912a67c7
--- /dev/null
+++ b/shell/ash_test/ash-heredoc/heredoc1.tests
@@ -0,0 +1,3 @@
+# We used to SEGV on this:
+
+<<EOF; then <W