[PATCH] nofork substitution bugfixes revealed by tests

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

This follows up to workers/51957 -- actual test file will be attached
to subsequent message.

diff --git b/Src/lex.c a/Src/lex.c
index 73d94264e..65d92cfac 100644
--- b/Src/lex.c
+++ a/Src/lex.c
@@ -1552,7 +1552,8 @@ dquote_parse(char endchar, int sub)
 		cmdpop();
 		cmdsubst = 0;
 	    }
-	    cmdpop();
+	    if (cmdsubst == 0)
+		cmdpop();
 	    break;
 	case '`':
 	    c = Qtick;
diff --git b/Src/subst.c a/Src/subst.c
index 92a53d99a..0fcc60020 100644
--- b/Src/subst.c
+++ a/Src/subst.c
@@ -1955,9 +1955,15 @@ paramsubst(LinkList l, LinkNode n, char **str, int qt, int pf_flags,
 	}
 
 	if (rplyvar && cmdarg && *cmdarg) {
+	    int obreaks = breaks;
 	    /* Execute the shell command */
 	    untokenize(cmdarg);
 	    execstring(cmdarg, 1, 0, "cmdsubst");
+	    /* "return" behaves as if in a function */
+	    if (retflag) {
+		retflag = 0;
+		breaks = obreaks;
+	    }
 	}
 
 	if (rplyvar) {
@@ -1984,7 +1990,6 @@ paramsubst(LinkList l, LinkNode n, char **str, int qt, int pf_flags,
 		} else
 		    _exit(exit_val);
 	    }
-	    retflag = 0; /* "return" behaves as if in a function */
 	}
 
 	/*