diff --git a/ChangeLog b/ChangeLog
index cd6e6e173..85e656658 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2016-01-04  Barton E. Schaefer  <schaefer@zsh.org>
+
+	* Jun T. (+ revise test): 37501: Src/builtin.c, Test/B03print.ztst:
+	correct byte counts when simulating memstream via temp file
+
 2016-01-02  Barton E. Schaefer  <schaefer@zsh.org>
 
 	* 37497: Src/builtin.c: handle NUL bytes in "printf -v".
diff --git a/Src/builtin.c b/Src/builtin.c
index 04d8f11d9..03fefa678 100644
--- a/Src/builtin.c
+++ b/Src/builtin.c
@@ -4879,10 +4879,10 @@ bin_print(char *name, char **args, Options ops, int func)
 #else
 	rewind(fout);
 	buf = (char *)zalloc(count + 1);
-	rcount = fread(buf, count, 1, fout);
+	rcount = fread(buf, 1, count, fout);
 	if (rcount < count)
 	    zwarnnam(name, "i/o error: %e", errno);
-	buf[rcount] = '\0';
+	buf[rcount++] = '\0';
 #endif
 	queue_signals();
 	stringval = metafy(buf, rcount - 1, META_REALLOC);
diff --git a/Test/B03print.ztst b/Test/B03print.ztst
index 2e9bf99e5..befe2f2dd 100644
--- a/Test/B03print.ztst
+++ b/Test/B03print.ztst
@@ -304,9 +304,9 @@
 
  unset foo
  print -v foo once more
- print -r -- $foo
- printf -v foo "%s-" into the breach
- print -r -- $foo
+ typeset -p foo
+ printf -v foo "%s\0%s-" into the breach
+ typeset -p foo
 0:print and printf into a variable
->once more
->into-the-breach-
+>typeset foo='once more'
+>typeset foo=$'into\C-@the-breach\C-@-'