diff --git a/ChangeLog b/ChangeLog
index 7f42c7fb..e55724f9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2021-11-12  Joerg Wunsch <j.gnu@uriah.heep.sax.de>
+
+	Submitted by Jon Thacker:
+	patch #9253: Fix for giving terminal_mode commands more than 20 arguments
+	* term.c (tokenize): fix realloc usage, pointer returned not necessarily
+	the same as pointer passed
+
 2021-11-12  Joerg Wunsch <j.gnu@uriah.heep.sax.de>
 
 	Submitted by Martino Facchin:
diff --git a/NEWS b/NEWS
index 791d9750..e6c91cd5 100644
--- a/NEWS
+++ b/NEWS
@@ -105,6 +105,7 @@ Current:
     patch #10017: uspasp / tpi: Automatically clear configuration byte (fuse) before writing it
     patch #8957: Allow reading prodsig memory from stk500v2 on xmega devices
     patch #9110: Let reserved fuse bits to be read as *don't care*
+    patch #9253: Fix for giving terminal_mode commands more than 20 arguments
 
   * Internals:
     - New avrdude.conf keyword "family_id", used to verify SIB attributes
diff --git a/term.c b/term.c
index f65610d3..f222fb46 100644
--- a/term.c
+++ b/term.c
@@ -780,11 +780,12 @@ static int cmd_verbose(PROGRAMMER * pgm, struct avrpart * p,
 
 static int tokenize(char * s, char *** argv)
 {
-  int     i, n, l, nargs, offset;
+  int     i, n, l, k, nargs, offset;
   int     len, slen;
   char  * buf;
   int     bufsize;
   char ** bufv;
+  char  * bufp;
   char  * q, * r;
   char  * nbuf;
   char ** av;
@@ -821,9 +822,15 @@ static int tokenize(char * s, char *** argv)
       /* realloc space for another 20 args */
       bufsize += 20;
       nargs   += 20;
+      bufp     = buf;
       buf      = realloc(buf, bufsize);
       bufv     = realloc(bufv, nargs*sizeof(char *));
       nbuf     = &buf[l];
+      /* correct bufv pointers */
+      k = buf - bufp;
+      for (i=0; i<n; i++) {
+          bufv[i] = bufv[i] + k;
+      }
       for (i=n; i<nargs; i++)
         bufv[i] = NULL;
     }