diff --git a/doc/htm8.md b/doc/htm8.md
index 924b6b659..a6418f509 100644
--- a/doc/htm8.md
+++ b/doc/htm8.md
@@ -144,6 +144,10 @@ This makes lexing the top-level structure easier.
 
 - HTM8 tags must be balanced to convert them to XML
 
+- `<script></SCRIPT>` isn't matched
+  - the begin and end tags must match exactly, like `<SCRipt></SCRipt>`
+  - likewise for `<style>`
+
 - NUL bytes aren't allowed - currently due to re2c sentinel.  Two options:
   1. Make it a syntax error - like JSON8
   1. we could have a reprocessing pass to convert it to the Unicode replacement
diff --git a/osh/word_parse.py b/osh/word_parse.py
index f0f77075e..29dd012c2 100644
--- a/osh/word_parse.py
+++ b/osh/word_parse.py
@@ -777,6 +777,9 @@ def _ReadDoubleQuotedLeftParts(self):
         if self.token_type == Id.Left_DollarBracket:
             return self._ReadExprSub(lex_mode_e.DQ)
 
+        if self.token_type == Id.Left_DollarBraceZsh:
+            return self._ReadZshVarSub(self.cur_token)
+
         raise AssertionError(self.cur_token)
 
     def _ReadYshSingleQuoted(self, left_id):
diff --git a/spec/zsh-idioms.test.sh b/spec/zsh-idioms.test.sh
index e40f74368..0b1f1a97d 100644
--- a/spec/zsh-idioms.test.sh
+++ b/spec/zsh-idioms.test.sh
@@ -26,20 +26,32 @@ fi
 
 #### zsh var sub is rejected at runtime
 
-echo z ${(m)foo} z
+eval 'echo z ${(m)foo} z'
+echo status=$?
+
+eval 'echo ${x:-${(m)foo}}'
+echo status=$?
+
+# double quoted
+eval 'echo "${(m)foo}"'
 echo status=$?
 
-## status: 1
 ## STDOUT:
+status=1
+status=1
+status=1
 ## END
 
 ## OK zsh status: 0
 ## OK zsh STDOUT:
 z z
+status=0
+
+status=0
+
 status=0
 ## END
 
-## OK bash status: 0
-## OK bash STDOUT:
-status=1
+## BUG mksh status: 1
+## BUG mksh STDOUT:
 ## END