diff --git a/NEWS b/NEWS
index 6eb121f68..81c4cbcdf 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,13 @@ For full details, see the git log at:
 
 Any uppercase BUG_* names are modernish shell bug IDs.
 
+2020-06-05:
+
+- Fix a bug that caused special variables such as PATH, LANG, LC_ALL,
+  etc. to lose their effect after being unset in a subshell. For example:
+    (unset PATH; PATH=/dev/null; ls); : wrongly ran 'ls'
+    (unset LC_ALL; LC_ALL=badlocale); : failed to print a diagnostic
+
 2020-06-04:
 
 - Fix BUG_KBGPID: the $! special parameter was not set if a background job
diff --git a/src/cmd/ksh93/bltins/typeset.c b/src/cmd/ksh93/bltins/typeset.c
index 276490350..99e7b0517 100644
--- a/src/cmd/ksh93/bltins/typeset.c
+++ b/src/cmd/ksh93/bltins/typeset.c
@@ -1209,6 +1209,33 @@ static int unall(int argc, char **argv, register Dt_t *troot, Shell_t* shp)
 		dtclear(troot);
 		return(r);
 	}
+
+	/*
+	 * Check for variables with internal trap/discipline functions (PATH, LANG, LC_*, LINENO, etc.).
+	 * Unsetting these in a virtual/non-forked subshell would cause them to lose their discipline actions,
+	 * so, for example, (unset PATH; PATH=/dev/null; ls) would run 'ls'! Until a fix is found, make the problem
+	 * go away by forking the subshell. To avoid crashing, this must be done before calling sh_pushcontext(),
+	 * so we need to loop through the args separately to check if any variable to unset has a discipline function.
+	 */
+	if(shp->subshell && !shp->subshare && troot==shp->var_tree)
+	{
+		char **argv_tmp = argv;
+		while(name = *argv_tmp++)
+		{
+			np=nv_open(name,troot,NV_NOADD|nflag);
+			if(!np)
+				continue;
+			/* Has discipline function, and is not a nameref? */
+			if(np->nvfun && np->nvfun->disc && !nv_isref(np))
+			{
+				nv_close(np);
+				sh_subfork();
+				break;
+			}
+			nv_close(np);
+		}
+	}
+
 	sh_pushcontext(shp,&buff,1);
 	while(name = *argv++)
 	{
diff --git a/src/cmd/ksh93/include/version.h b/src/cmd/ksh93/include/version.h
index be7f88eba..b8faf4c5a 100644
--- a/src/cmd/ksh93/include/version.h
+++ b/src/cmd/ksh93/include/version.h
@@ -17,4 +17,4 @@
 *                  David Korn <dgk@research.att.com>                   *
 *                                                                      *
 ***********************************************************************/
-#define SH_RELEASE	"93u+m 2020-06-04"
+#define SH_RELEASE	"93u+m 2020-06-05"
diff --git a/src/cmd/ksh93/tests/variables.sh b/src/cmd/ksh93/tests/variables.sh
index 34f4899df..f82cda7fd 100755
--- a/src/cmd/ksh93/tests/variables.sh
+++ b/src/cmd/ksh93/tests/variables.sh
@@ -642,9 +642,6 @@ set --
 		fi
 	done
 
-	# TODO: changing the locale is somehow broken in non-forked/virtual subshells.
-	# For now, fork it using ulimit; remove the ulimit to expose the test failures.
-	ulimit -t unlimited
 	x=x
 	for v in LC_ALL LC_CTYPE LC_MESSAGES LC_COLLATE LC_NUMERIC
 	do	nameref r=$v