diff --git a/libc/Android.bp b/libc/Android.bp
index be1c6f9..842dae4 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -13,6 +13,7 @@
     "bionic/sigblock.c",
     "bionic/siginterrupt.c",
     "bionic/sigsetmask.c",
+    "stdio/fmemopen.cpp",
     "stdio/fread.c",
     "stdio/parsefloat.c",
     "stdio/refill.c",
@@ -439,7 +440,6 @@
         "upstream-openbsd/lib/libc/stdio/fgetwc.c",
         "upstream-openbsd/lib/libc/stdio/fgetws.c",
         "upstream-openbsd/lib/libc/stdio/flags.c",
-        "upstream-openbsd/lib/libc/stdio/fmemopen.c",
         "upstream-openbsd/lib/libc/stdio/fpurge.c",
         "upstream-openbsd/lib/libc/stdio/fputs.c",
         "upstream-openbsd/lib/libc/stdio/fputwc.c",
diff --git a/libc/NOTICE b/libc/NOTICE
index ae98d1d..90de7ef 100644
--- a/libc/NOTICE
+++ b/libc/NOTICE
@@ -682,6 +682,31 @@
 
 -------------------------------------------------------------------
 
+Copyright (C) 2013 Pietro Cerutti <gahr@FreeBSD.org>
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
 Copyright (C) 2013 The Android Open Source Project
 
 Licensed under the Apache License, Version 2.0 (the "License");
@@ -5071,23 +5096,6 @@
 
 -------------------------------------------------------------------
 
-Copyright (c) 2011 Martin Pieuchot <mpi@openbsd.org>
-Copyright (c) 2009 Ted Unangst
-
-Permission to use, copy, modify, and distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
--------------------------------------------------------------------
-
 Copyright (c) 2011 The Android Open Source Project
 Copyright (c) 2008 ARM Ltd
 All rights reserved.
diff --git a/libc/stdio/fmemopen.cpp b/libc/stdio/fmemopen.cpp
new file mode 100644
index 0000000..9d8c41f
--- /dev/null
+++ b/libc/stdio/fmemopen.cpp
@@ -0,0 +1,156 @@
+/*-
+ * Copyright (C) 2013 Pietro Cerutti <gahr@FreeBSD.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "local.h"
+
+// See http://pubs.opengroup.org/onlinepubs/9699919799/functions/fmemopen.html
+// and http://man7.org/linux/man-pages/man3/fmemopen.3.html for documentation.
+
+struct fmemopen_cookie {
+  char* buf;
+  char* allocation;
+  size_t capacity;
+  size_t size;
+  size_t offset;
+  bool append;
+};
+
+static int fmemopen_read(void* cookie, char* buf, int n) {
+  fmemopen_cookie* ck = static_cast<fmemopen_cookie*>(cookie);
+
+  if (static_cast<size_t>(n) > ck->size - ck->offset) n = ck->size - ck->offset;
+
+  if (n > 0) {
+    memmove(buf, ck->buf + ck->offset, n);
+    ck->offset += n;
+  }
+  return n;
+}
+
+static int fmemopen_write(void* cookie, const char* buf, int n) {
+  fmemopen_cookie* ck = static_cast<fmemopen_cookie*>(cookie);
+
+  // We don't need to add the trailing NUL if there's already a trailing NUL
+  // in the data we're writing.
+  size_t space_for_null = (n > 0 && buf[n - 1] != '\0') ? 1 : 0;
+
+  // Undo any seeking/reading on an append-only stream.
+  if (ck->append) ck->offset = ck->size;
+
+  // How much can we actually fit?
+  if (static_cast<size_t>(n) + space_for_null > ck->capacity - ck->offset) {
+    n = ck->capacity - ck->offset - space_for_null;
+    // Give up if we don't even have room for one byte of userdata.
+    if (n <= 0) {
+      errno = ENOSPC;
+      return -1;
+    }
+  }
+
+  if (n > 0) {
+    memmove(ck->buf + ck->offset, buf, n);
+    ck->offset += n;
+    // Is this the furthest we've ever been?
+    if (ck->offset >= ck->size) {
+      if (buf[n - 1] != '\0') ck->buf[ck->offset] = '\0';
+      ck->size = ck->offset;
+    }
+  }
+  return n;
+}
+
+static fpos_t fmemopen_seek(void* cookie, fpos_t offset, int whence) {
+  fmemopen_cookie* ck = static_cast<fmemopen_cookie*>(cookie);
+
+  if (whence == SEEK_SET && (offset >= 0 && static_cast<size_t>(offset) <= ck->capacity)) {
+    return (ck->offset = offset);
+  } else if (whence == SEEK_CUR && (ck->offset + offset <= ck->capacity)) {
+    return (ck->offset += offset);
+  } else if (whence == SEEK_END && (offset <= 0 && static_cast<size_t>(-offset) <= ck->size)) {
+    return (ck->offset = ck->size + offset);
+  }
+  errno = EINVAL;
+  return -1;
+}
+
+static int fmemopen_close(void* cookie) {
+  fmemopen_cookie* ck = static_cast<fmemopen_cookie*>(cookie);
+  free(ck->allocation);
+  free(ck);
+  return 0;
+}
+
+FILE* fmemopen(void* buf, size_t capacity, const char* mode) {
+  int flags;
+  if (__sflags(mode, &flags) == 0) {
+    errno = EINVAL;
+    return nullptr;
+  }
+
+  fmemopen_cookie* ck = static_cast<fmemopen_cookie*>(calloc(sizeof(fmemopen_cookie), 1));
+  if (ck == nullptr) return nullptr;
+
+  ck->buf = static_cast<char*>(buf);
+  ck->capacity = capacity;
+
+  if (ck->buf == nullptr) ck->buf = ck->allocation = static_cast<char*>(calloc(capacity, 1));
+  if (ck->buf == nullptr) {
+    free(ck);
+    return nullptr;
+  }
+
+  FILE* fp = funopen(ck,
+                     (flags & O_WRONLY) ? nullptr : fmemopen_read,
+                     (flags & O_RDONLY) ? nullptr : fmemopen_write,
+                     fmemopen_seek,
+                     fmemopen_close);
+  if (fp == nullptr) {
+    fmemopen_close(ck);
+    return nullptr;
+  }
+
+  if (mode[0] == 'a') {
+    ck->size = strnlen(ck->buf, ck->capacity);
+    ck->offset = ck->size;
+    ck->append = true;
+  } else if (mode[0] == 'r') {
+    ck->size = capacity;
+    ck->offset = 0;
+  } else if (mode[0] == 'w') {
+    ck->size = 0;
+    ck->offset = 0;
+    ck->buf[0] = '\0';
+  }
+
+  return fp;
+}
diff --git a/libc/upstream-openbsd/lib/libc/stdio/fmemopen.c b/libc/upstream-openbsd/lib/libc/stdio/fmemopen.c
deleted file mode 100644
index 00c2764..0000000
--- a/libc/upstream-openbsd/lib/libc/stdio/fmemopen.c
+++ /dev/null
@@ -1,184 +0,0 @@
-/*	$OpenBSD: fmemopen.c,v 1.3 2015/08/31 02:53:57 guenther Exp $	*/
-
-/*
- * Copyright (c) 2011 Martin Pieuchot <mpi@openbsd.org>
- * Copyright (c) 2009 Ted Unangst
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <errno.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include "local.h"
-
-struct state {
-	char		*string;	/* actual stream */
-	size_t		 pos;		/* current position */
-	size_t		 size;		/* allocated size */
-	size_t		 len;		/* length of the data */
-	int		 update;	/* open for update */
-};
-
-static int
-fmemopen_read(void *v, char *b, int l)
-{
-	struct state	*st = v;
-	int		 i;
-
-	for (i = 0; i < l && i + st->pos < st->len; i++)
-		b[i] = st->string[st->pos + i];
-	st->pos += i;
-
-	return (i);
-}
-
-static int
-fmemopen_write(void *v, const char *b, int l)
-{
-	struct state	*st = v;
-	int		i;
-
-	for (i = 0; i < l && i + st->pos < st->size; i++)
-		st->string[st->pos + i] = b[i];
-	st->pos += i;
-
-	if (st->pos >= st->len) {
-		st->len = st->pos;
-
-		if (st->len < st->size)
-			st->string[st->len] = '\0';
-		else if (!st->update)
-			st->string[st->size - 1] = '\0';
-	}
-
-	return (i);
-}
-
-static fpos_t
-fmemopen_seek(void *v, fpos_t off, int whence)
-{
-	struct state	*st = v;
-	ssize_t		 base = 0;
-
-	switch (whence) {
-	case SEEK_SET:
-		break;
-	case SEEK_CUR:
-		base = st->pos;
-		break;
-	case SEEK_END:
-		base = st->len;
-		break;
-	}
-
-	if (off > st->size - base || off < -base) {
-		errno = EOVERFLOW;
-		return (-1);
-	}
-
-	st->pos = base + off;
-
-	return (st->pos);
-}
-
-static int
-fmemopen_close(void *v)
-{
-	free(v);
-
-	return (0);
-}
-
-static int
-fmemopen_close_free(void *v)
-{
-	struct state	*st = v;
-
-	free(st->string);
-	free(st);
-
-	return (0);
-}
-
-FILE *
-fmemopen(void *buf, size_t size, const char *mode)
-{
-	struct state	*st;
-	FILE		*fp;
-	int		 flags, oflags;
-
-	if (size == 0) {
-		errno = EINVAL;
-		return (NULL);
-	}
-
-	if ((flags = __sflags(mode, &oflags)) == 0) {
-		errno = EINVAL;
-		return (NULL);
-	}
-
-	if (buf == NULL && ((oflags & O_RDWR) == 0)) {
-		errno = EINVAL;
-		return (NULL);
-	}
-
-	if ((st = malloc(sizeof(*st))) == NULL)
-		return (NULL);
-
-	if ((fp = __sfp()) == NULL) {
-		free(st);
-		return (NULL);
-	}
-
-	st->pos = 0;
-	st->len = (oflags & O_WRONLY) ? 0 : size;
-	st->size = size;
-	st->update = oflags & O_RDWR;
-
-	if (buf == NULL) {
-		if ((st->string = malloc(size)) == NULL) {
-			free(st);
-			fp->_flags = 0;
-			return (NULL);
-		}
-		*st->string = '\0';
-	} else {
-		st->string = (char *)buf;
-
-		if (oflags & O_TRUNC)
-			*st->string = '\0';
-
-		if (oflags & O_APPEND) {
-			char	*p;
-
-			if ((p = memchr(st->string, '\0', size)) != NULL)
-				st->pos = st->len = (p - st->string);
-			else
-				st->pos = st->len = size;
-		}
-	}
-
-	fp->_flags = (short)flags;
-	fp->_file = -1;
-	fp->_cookie = (void *)st;
-	fp->_read = (flags & __SWR) ? NULL : fmemopen_read;
-	fp->_write = (flags & __SRD) ? NULL : fmemopen_write;
-	fp->_seek = fmemopen_seek;
-	fp->_close = (buf == NULL) ? fmemopen_close_free : fmemopen_close;
-
-	return (fp);
-}
-DEF_WEAK(fmemopen);
diff --git a/tests/stdio_test.cpp b/tests/stdio_test.cpp
index da70d21..1f27c83 100644
--- a/tests/stdio_test.cpp
+++ b/tests/stdio_test.cpp
@@ -27,6 +27,7 @@
 #include <wchar.h>
 #include <locale.h>
 
+#include <string>
 #include <vector>
 
 #include "BionicDeathTest.h"
@@ -41,6 +42,8 @@
 #define STDIO_DEATHTEST stdio_DeathTest
 #endif
 
+using namespace std::string_literals;
+
 class stdio_DeathTest : public BionicDeathTest {};
 class stdio_nofortify_DeathTest : public BionicDeathTest {};
 
@@ -923,7 +926,7 @@
   ASSERT_EQ(WEOF, fgetwc(fp));
   ASSERT_EQ(EILSEQ, errno);
 
-  fclose(fp);
+  ASSERT_EQ(0, fclose(fp));
 }
 
 TEST(STDIO_TEST, fmemopen) {
@@ -934,32 +937,410 @@
   ASSERT_NE(EOF, fputs("abc>\n", fp));
   fflush(fp);
 
+  // We wrote to the buffer...
   ASSERT_STREQ("<abc>\n", buf);
 
+  // And can read back from the file.
   AssertFileIs(fp, "<abc>\n", true);
-  fclose(fp);
+  ASSERT_EQ(0, fclose(fp));
 }
 
-TEST(STDIO_TEST, KNOWN_FAILURE_ON_BIONIC(fmemopen_NULL)) {
+TEST(STDIO_TEST, fmemopen_nullptr) {
   FILE* fp = fmemopen(nullptr, 128, "r+");
   ASSERT_NE(EOF, fputs("xyz\n", fp));
 
   AssertFileIs(fp, "xyz\n", true);
-  fclose(fp);
+  ASSERT_EQ(0, fclose(fp));
 }
 
-TEST(STDIO_TEST, fmemopen_EINVAL) {
+TEST(STDIO_TEST, fmemopen_trailing_NUL_byte) {
+  FILE* fp;
+  char buf[8];
+
+  // POSIX: "When a stream open for writing is flushed or closed, a null byte
+  // shall be written at the current position or at the end of the buffer,
+  // depending on the size of the contents."
+  memset(buf, 'x', sizeof(buf));
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "w"));
+  // Even with nothing written (and not in truncate mode), we'll flush a NUL...
+  ASSERT_EQ(0, fflush(fp));
+  EXPECT_EQ("\0xxxxxxx"s, std::string(buf, buf + sizeof(buf)));
+  // Now write and check that the NUL moves along with our writes...
+  ASSERT_NE(EOF, fputs("hello", fp));
+  ASSERT_EQ(0, fflush(fp));
+  EXPECT_EQ("hello\0xx"s, std::string(buf, buf + sizeof(buf)));
+  ASSERT_NE(EOF, fputs("wo", fp));
+  ASSERT_EQ(0, fflush(fp));
+  EXPECT_EQ("hellowo\0"s, std::string(buf, buf + sizeof(buf)));
+  ASSERT_EQ(0, fclose(fp));
+
+  // "If a stream open for update is flushed or closed and the last write has
+  // advanced the current buffer size, a null byte shall be written at the end
+  // of the buffer if it fits."
+  memset(buf, 'x', sizeof(buf));
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "r+"));
+  // Nothing written yet, so no advance...
+  ASSERT_EQ(0, fflush(fp));
+  EXPECT_EQ("xxxxxxxx"s, std::string(buf, buf + sizeof(buf)));
+  ASSERT_NE(EOF, fputs("hello", fp));
+  ASSERT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_size) {
+  FILE* fp;
   char buf[16];
+  memset(buf, 'x', sizeof(buf));
 
-  // Invalid size.
-  errno = 0;
-  ASSERT_EQ(nullptr, fmemopen(buf, 0, "r+"));
-  ASSERT_EQ(EINVAL, errno);
+  // POSIX: "The stream shall also maintain the size of the current buffer
+  // contents; use of fseek() or fseeko() on the stream with SEEK_END shall
+  // seek relative to this size."
 
-  // No '+' with NULL buffer.
+  // "For modes r and r+ the size shall be set to the value given by the size
+  // argument."
+  ASSERT_NE(nullptr, fp = fmemopen(buf, 16, "r"));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(16, ftell(fp));
+  EXPECT_EQ(16, ftello(fp));
+  ASSERT_EQ(0, fseeko(fp, 0, SEEK_END));
+  EXPECT_EQ(16, ftell(fp));
+  EXPECT_EQ(16, ftello(fp));
+  ASSERT_EQ(0, fclose(fp));
+  ASSERT_NE(nullptr, fp = fmemopen(buf, 16, "r+"));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(16, ftell(fp));
+  EXPECT_EQ(16, ftello(fp));
+  ASSERT_EQ(0, fseeko(fp, 0, SEEK_END));
+  EXPECT_EQ(16, ftell(fp));
+  EXPECT_EQ(16, ftello(fp));
+  ASSERT_EQ(0, fclose(fp));
+
+  // "For modes w and w+ the initial size shall be zero..."
+  ASSERT_NE(nullptr, fp = fmemopen(nullptr, 16, "w"));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(0, ftell(fp));
+  EXPECT_EQ(0, ftello(fp));
+  ASSERT_EQ(0, fseeko(fp, 0, SEEK_END));
+  EXPECT_EQ(0, ftell(fp));
+  EXPECT_EQ(0, ftello(fp));
+  ASSERT_EQ(0, fclose(fp));
+  ASSERT_NE(nullptr, fp = fmemopen(nullptr, 16, "w+"));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(0, ftell(fp));
+  EXPECT_EQ(0, ftello(fp));
+  ASSERT_EQ(0, fseeko(fp, 0, SEEK_END));
+  EXPECT_EQ(0, ftell(fp));
+  EXPECT_EQ(0, ftello(fp));
+  ASSERT_EQ(0, fclose(fp));
+
+  // "...and for modes a and a+ the initial size shall be:
+  // 1. Zero, if buf is a null pointer
+  ASSERT_NE(nullptr, fp = fmemopen(nullptr, 16, "a"));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(0, ftell(fp));
+  EXPECT_EQ(0, ftello(fp));
+  ASSERT_EQ(0, fseeko(fp, 0, SEEK_END));
+  EXPECT_EQ(0, ftell(fp));
+  EXPECT_EQ(0, ftello(fp));
+  ASSERT_EQ(0, fclose(fp));
+  ASSERT_NE(nullptr, fp = fmemopen(nullptr, 16, "a+"));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(0, ftell(fp));
+  EXPECT_EQ(0, ftello(fp));
+  ASSERT_EQ(0, fseeko(fp, 0, SEEK_END));
+  EXPECT_EQ(0, ftell(fp));
+  EXPECT_EQ(0, ftello(fp));
+  ASSERT_EQ(0, fclose(fp));
+
+  // 2. The position of the first null byte in the buffer, if one is found
+  memset(buf, 'x', sizeof(buf));
+  buf[3] = '\0';
+  ASSERT_NE(nullptr, fp = fmemopen(buf, 16, "a"));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(3, ftell(fp));
+  EXPECT_EQ(3, ftello(fp));
+  ASSERT_EQ(0, fseeko(fp, 0, SEEK_END));
+  EXPECT_EQ(3, ftell(fp));
+  EXPECT_EQ(3, ftello(fp));
+  ASSERT_EQ(0, fclose(fp));
+  memset(buf, 'x', sizeof(buf));
+  buf[3] = '\0';
+  ASSERT_NE(nullptr, fp = fmemopen(buf, 16, "a+"));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(3, ftell(fp));
+  EXPECT_EQ(3, ftello(fp));
+  ASSERT_EQ(0, fseeko(fp, 0, SEEK_END));
+  EXPECT_EQ(3, ftell(fp));
+  EXPECT_EQ(3, ftello(fp));
+  ASSERT_EQ(0, fclose(fp));
+
+  // 3. The value of the size argument, if buf is not a null pointer and no
+  // null byte is found.
+  memset(buf, 'x', sizeof(buf));
+  ASSERT_NE(nullptr, fp = fmemopen(buf, 16, "a"));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(16, ftell(fp));
+  EXPECT_EQ(16, ftello(fp));
+  ASSERT_EQ(0, fseeko(fp, 0, SEEK_END));
+  EXPECT_EQ(16, ftell(fp));
+  EXPECT_EQ(16, ftello(fp));
+  ASSERT_EQ(0, fclose(fp));
+  memset(buf, 'x', sizeof(buf));
+  ASSERT_NE(nullptr, fp = fmemopen(buf, 16, "a+"));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(16, ftell(fp));
+  EXPECT_EQ(16, ftello(fp));
+  ASSERT_EQ(0, fseeko(fp, 0, SEEK_END));
+  EXPECT_EQ(16, ftell(fp));
+  EXPECT_EQ(16, ftello(fp));
+  ASSERT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_SEEK_END) {
+  // fseek SEEK_END is relative to the current string length, not the buffer size.
+  FILE* fp;
+  char buf[8];
+  memset(buf, 'x', sizeof(buf));
+  strcpy(buf, "str");
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "w+"));
+  ASSERT_NE(EOF, fputs("string", fp));
+  EXPECT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(static_cast<long>(strlen("string")), ftell(fp));
+  EXPECT_EQ(static_cast<off_t>(strlen("string")), ftello(fp));
+  EXPECT_EQ(0, fclose(fp));
+
+  // glibc < 2.22 interpreted SEEK_END the wrong way round (subtracting rather
+  // than adding).
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "w+"));
+  ASSERT_NE(EOF, fputs("54321", fp));
+  EXPECT_EQ(0, fseek(fp, -2, SEEK_END));
+  EXPECT_EQ('2', fgetc(fp));
+  EXPECT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_seek_invalid) {
+  char buf[8];
+  memset(buf, 'x', sizeof(buf));
+  FILE* fp = fmemopen(buf, sizeof(buf), "w");
+  ASSERT_TRUE(fp != nullptr);
+
+  // POSIX: "An attempt to seek ... to a negative position or to a position
+  // larger than the buffer size given in the size argument shall fail."
+  // (There's no mention of what errno should be set to, and glibc doesn't
+  // set errno in any of these cases.)
+  EXPECT_EQ(-1, fseek(fp, -2, SEEK_SET));
+  EXPECT_EQ(-1, fseeko(fp, -2, SEEK_SET));
+  EXPECT_EQ(-1, fseek(fp, sizeof(buf) + 1, SEEK_SET));
+  EXPECT_EQ(-1, fseeko(fp, sizeof(buf) + 1, SEEK_SET));
+}
+
+TEST(STDIO_TEST, fmemopen_read_EOF) {
+  // POSIX: "A read operation on the stream shall not advance the current
+  // buffer position beyond the current buffer size."
+  char buf[8];
+  memset(buf, 'x', sizeof(buf));
+  FILE* fp = fmemopen(buf, sizeof(buf), "r");
+  ASSERT_TRUE(fp != nullptr);
+  char buf2[BUFSIZ];
+  ASSERT_EQ(8U, fread(buf2, 1, sizeof(buf2), fp));
+  // POSIX: "Reaching the buffer size in a read operation shall count as
+  // end-of-file.
+  ASSERT_TRUE(feof(fp));
+  ASSERT_EQ(EOF, fgetc(fp));
+  ASSERT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_read_null_bytes) {
+  // POSIX: "Null bytes in the buffer shall have no special meaning for reads."
+  char buf[] = "h\0e\0l\0l\0o";
+  FILE* fp = fmemopen(buf, sizeof(buf), "r");
+  ASSERT_TRUE(fp != nullptr);
+  ASSERT_EQ('h', fgetc(fp));
+  ASSERT_EQ(0, fgetc(fp));
+  ASSERT_EQ('e', fgetc(fp));
+  ASSERT_EQ(0, fgetc(fp));
+  ASSERT_EQ('l', fgetc(fp));
+  ASSERT_EQ(0, fgetc(fp));
+  // POSIX: "The read operation shall start at the current buffer position of
+  // the stream."
+  char buf2[8];
+  memset(buf2, 'x', sizeof(buf2));
+  ASSERT_EQ(4U, fread(buf2, 1, sizeof(buf2), fp));
+  ASSERT_EQ('l', buf2[0]);
+  ASSERT_EQ(0, buf2[1]);
+  ASSERT_EQ('o', buf2[2]);
+  ASSERT_EQ(0, buf2[3]);
+  for (size_t i = 4; i < sizeof(buf2); ++i) ASSERT_EQ('x', buf2[i]) << i;
+  ASSERT_TRUE(feof(fp));
+  ASSERT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_write) {
+  FILE* fp;
+  char buf[8];
+
+  // POSIX: "A write operation shall start either at the current position of
+  // the stream (if mode has not specified 'a' as the first character)..."
+  memset(buf, 'x', sizeof(buf));
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "r+"));
+  setbuf(fp, nullptr); // Turn off buffering so we can see what's happening as it happens.
+  ASSERT_EQ(0, fseek(fp, 2, SEEK_SET));
+  ASSERT_EQ(' ', fputc(' ', fp));
+  EXPECT_EQ("xx xxxxx", std::string(buf, buf + sizeof(buf)));
+  ASSERT_EQ(0, fclose(fp));
+
+  // "...or at the current size of the stream (if mode had 'a' as the first
+  // character)." (See the fmemopen_size test for what "size" means, but for
+  // mode "a", it's the first NUL byte.)
+  memset(buf, 'x', sizeof(buf));
+  buf[3] = '\0';
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "a+"));
+  setbuf(fp, nullptr); // Turn off buffering so we can see what's happening as it happens.
+  ASSERT_EQ(' ', fputc(' ', fp));
+  EXPECT_EQ("xxx \0xxx"s, std::string(buf, buf + sizeof(buf)));
+  ASSERT_EQ(0, fclose(fp));
+
+  // "If the current position at the end of the write is larger than the
+  // current buffer size, the current buffer size shall be set to the current
+  // position." (See the fmemopen_size test for what "size" means, but to
+  // query it we SEEK_END with offset 0, and then ftell.)
+  memset(buf, 'x', sizeof(buf));
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "w+"));
+  setbuf(fp, nullptr); // Turn off buffering so we can see what's happening as it happens.
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(0, ftell(fp));
+  ASSERT_EQ(' ', fputc(' ', fp));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(1, ftell(fp));
+  ASSERT_NE(EOF, fputs("123", fp));
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_END));
+  EXPECT_EQ(4, ftell(fp));
+  EXPECT_EQ(" 123\0xxx"s, std::string(buf, buf + sizeof(buf)));
+  ASSERT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_write_EOF) {
+  // POSIX: "A write operation on the stream shall not advance the current
+  // buffer size beyond the size given in the size argument."
+  FILE* fp;
+
+  // Scalar writes...
+  ASSERT_NE(nullptr, fp = fmemopen(nullptr, 4, "w"));
+  setbuf(fp, nullptr); // Turn off buffering so we can see what's happening as it happens.
+  ASSERT_EQ('x', fputc('x', fp));
+  ASSERT_EQ('x', fputc('x', fp));
+  ASSERT_EQ('x', fputc('x', fp));
+  ASSERT_EQ(EOF, fputc('x', fp)); // Only 3 fit because of the implicit NUL.
+  ASSERT_EQ(0, fclose(fp));
+
+  // Vector writes...
+  ASSERT_NE(nullptr, fp = fmemopen(nullptr, 4, "w"));
+  setbuf(fp, nullptr); // Turn off buffering so we can see what's happening as it happens.
+  ASSERT_EQ(3U, fwrite("xxxx", 1, 4, fp));
+  ASSERT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_initial_position) {
+  // POSIX: "The ... current position in the buffer ... shall be initially
+  // set to either the beginning of the buffer (for r and w modes) ..."
+  char buf[] = "hello\0world";
+  FILE* fp;
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "r"));
+  EXPECT_EQ(0L, ftell(fp));
+  EXPECT_EQ(0, fclose(fp));
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "w"));
+  EXPECT_EQ(0L, ftell(fp));
+  EXPECT_EQ(0, fclose(fp));
+  buf[0] = 'h'; // (Undo the effects of the above.)
+
+  // POSIX: "...or to the first null byte in the buffer (for a modes)."
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "a"));
+  EXPECT_EQ(5L, ftell(fp));
+  EXPECT_EQ(0, fclose(fp));
+
+  // POSIX: "If no null byte is found in append mode, the initial position
+  // shall be set to one byte after the end of the buffer."
+  memset(buf, 'x', sizeof(buf));
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "a"));
+  EXPECT_EQ(static_cast<long>(sizeof(buf)), ftell(fp));
+  EXPECT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_initial_position_allocated) {
+  // POSIX: "If buf is a null pointer, the initial position shall always be
+  // set to the beginning of the buffer."
+  FILE* fp = fmemopen(nullptr, 128, "a+");
+  ASSERT_TRUE(fp != nullptr);
+  EXPECT_EQ(0L, ftell(fp));
+  EXPECT_EQ(0L, fseek(fp, 0, SEEK_SET));
+  EXPECT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_zero_length) {
+  // POSIX says it's up to the implementation whether or not you can have a
+  // zero-length buffer (but "A future version of this standard may require
+  // support of zero-length buffer streams explicitly"). BSD and glibc < 2.22
+  // agreed that you couldn't, but glibc >= 2.22 allows it for consistency.
+  FILE* fp;
+  char buf[16];
+  ASSERT_NE(nullptr, fp = fmemopen(buf, 0, "r+"));
+  ASSERT_EQ(EOF, fgetc(fp));
+  ASSERT_TRUE(feof(fp));
+  ASSERT_EQ(0, fclose(fp));
+  ASSERT_NE(nullptr, fp = fmemopen(nullptr, 0, "r+"));
+  ASSERT_EQ(EOF, fgetc(fp));
+  ASSERT_TRUE(feof(fp));
+  ASSERT_EQ(0, fclose(fp));
+
+  ASSERT_NE(nullptr, fp = fmemopen(buf, 0, "w+"));
+  setbuf(fp, nullptr); // Turn off buffering so we can see what's happening as it happens.
+  ASSERT_EQ(EOF, fputc('x', fp));
+  ASSERT_EQ(0, fclose(fp));
+  ASSERT_NE(nullptr, fp = fmemopen(nullptr, 0, "w+"));
+  setbuf(fp, nullptr); // Turn off buffering so we can see what's happening as it happens.
+  ASSERT_EQ(EOF, fputc('x', fp));
+  ASSERT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_write_only_allocated) {
+  // POSIX says fmemopen "may fail if the mode argument does not include a '+'".
+  // BSD fails, glibc doesn't. We side with the more lenient.
+  FILE* fp;
+  ASSERT_NE(nullptr, fp = fmemopen(nullptr, 16, "r"));
+  ASSERT_EQ(0, fclose(fp));
+  ASSERT_NE(nullptr, fp = fmemopen(nullptr, 16, "w"));
+  ASSERT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_fileno) {
+  // There's no fd backing an fmemopen FILE*.
+  FILE* fp = fmemopen(nullptr, 16, "r");
+  ASSERT_TRUE(fp != nullptr);
   errno = 0;
-  ASSERT_EQ(nullptr, fmemopen(nullptr, 0, "r"));
-  ASSERT_EQ(EINVAL, errno);
+  ASSERT_EQ(-1, fileno(fp));
+  ASSERT_EQ(EBADF, errno);
+  ASSERT_EQ(0, fclose(fp));
+}
+
+TEST(STDIO_TEST, fmemopen_append_after_seek) {
+  // In BSD and glibc < 2.22, append mode didn't force writes to append if
+  // there had been an intervening seek.
+
+  FILE* fp;
+  char buf[] = "hello\0world";
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "a"));
+  setbuf(fp, nullptr); // Turn off buffering so we can see what's happening as it happens.
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_SET));
+  ASSERT_NE(EOF, fputc('!', fp));
+  EXPECT_EQ("hello!\0orld\0"s, std::string(buf, buf + sizeof(buf)));
+  ASSERT_EQ(0, fclose(fp));
+
+  memcpy(buf, "hello\0world", sizeof(buf));
+  ASSERT_NE(nullptr, fp = fmemopen(buf, sizeof(buf), "a+"));
+  setbuf(fp, nullptr); // Turn off buffering so we can see what's happening as it happens.
+  ASSERT_EQ(0, fseek(fp, 0, SEEK_SET));
+  ASSERT_NE(EOF, fputc('!', fp));
+  EXPECT_EQ("hello!\0orld\0"s, std::string(buf, buf + sizeof(buf)));
+  ASSERT_EQ(0, fclose(fp));
 }
 
 TEST(STDIO_TEST, open_memstream) {