diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 6f2872f..bf7b31b 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -3187,18 +3187,18 @@
             argc = 0;
             guest_argp = arg2;
             for (gp = guest_argp; ; gp++) {
-                if (get_user_ual(guest_argp, gp))
+                if (get_user_ual(addr, gp))
                     goto efault;
-                if (!guest_argp)
+                if (!addr)
                     break;
                 argc++;
             }
             envc = 0;
             guest_envp = arg3;
             for (gp = guest_envp; ; gp++) {
-                if (get_user_ual(guest_envp, gp))
+                if (get_user_ual(addr, gp))
                     goto efault;
-                if (!guest_envp)
+                if (!addr)
                     break;
                 envc++;
             }