diff --git a/ChangeLog b/ChangeLog
index 5cb04951e..f32a61902 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -28,13 +28,16 @@
      Add "Match LocalAddress" and "Match LocalPort" to sshd and adjust tests
      to match.  Feedback and ok djm@ markus@.
    - djm@cvs.openbsd.org 2012/06/01 00:47:35
-     [multiplex.sh forwarding.sh]
+     [regress/multiplex.sh regress/forwarding.sh]
      append to rather than truncate test log; bz#2013 from openssh AT
      roumenpetrov.info
    - djm@cvs.openbsd.org 2012/06/01 00:52:52
-     [sftp-cmds.sh]
+     [regress/sftp-cmds.sh]
      don't delete .* on cleanup due to unintended env expansion; pointed out in
      bz#2014 by openssh AT roumenpetrov.info
+   - dtucker@cvs.openbsd.org 2012/06/26 12:06:59
+     [regress/connect-privsep.sh]
+     test sandbox with every malloc option
 
 20120628
  - (dtucker) [openbsd-compat/getrrsetbyname-ldns.c] bz #2022: prevent null
diff --git a/regress/connect-privsep.sh b/regress/connect-privsep.sh
index 11fb9aef9..f24010355 100644
--- a/regress/connect-privsep.sh
+++ b/regress/connect-privsep.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: connect-privsep.sh,v 1.2 2011/06/30 22:44:43 markus Exp $
+#	$OpenBSD: connect-privsep.sh,v 1.3 2012/06/26 12:06:59 dtucker Exp $
 #	Placed in the Public Domain.
 
 tid="proxy connect with privsep"
@@ -23,3 +23,16 @@ for p in 1 2; do
 		warn "ssh privsep/sandbox+proxyconnect protocol $p failed"
 	fi
 done
+
+# Because sandbox is sensitive to changes in libc, especially malloc, retest
+# with every malloc.conf option (and none).
+for m in '' A F G H J P R S X Z '<' '>'; do
+    for p in 1 2; do
+	env MALLOC_OPTIONS="$m" ${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
+	if [ $? -ne 0 ]; then
+		fail "ssh privsep/sandbox+proxyconnect protocol $p mopt '$m' failed"
+	fi
+    done
+done
+
+exit