Index: bin/sh/parser.c
===================================================================
--- bin/sh/parser.c	(revision 180502)
+++ bin/sh/parser.c	(working copy)
@@ -620,9 +620,9 @@
 	if (!err)
 		n->ndup.vname = NULL;
 
-	if (is_digit(text[0]) && text[1] == '\0')
+	if (text != NULL && is_digit(text[0]) && text[1] == '\0')
 		n->ndup.dupfd = digit_val(text[0]);
-	else if (text[0] == '-' && text[1] == '\0')
+	else if (text != NULL && text[0] == '-' && text[1] == '\0')
 		n->ndup.dupfd = -1;
 	else {
 
Index: tools/regression/bin/sh/errors/redirection-error.2
===================================================================
--- tools/regression/bin/sh/errors/redirection-error.2	(revision 0)
+++ tools/regression/bin/sh/errors/redirection-error.2	(revision 0)
@@ -0,0 +1,4 @@
+# $FreeBSD$
+
+# sh should fail gracefully on this bad redirect
+sh -c 'echo 1 >&$a' 2>/dev/null