diff --git a/src/testdir/test_vim9_func.vim b/src/testdir/test_vim9_func.vim
index 0fd2892..e1b3b7f 100644
--- a/src/testdir/test_vim9_func.vim
+++ b/src/testdir/test_vim9_func.vim
@@ -113,6 +113,7 @@
   call CheckDefFailure(['TakesOneArg()'], 'E119:')
   call CheckDefFailure(['TakesOneArg(11, 22)'], 'E118:')
   call CheckDefFailure(['bufnr(xxx)'], 'E1001:')
+  call CheckScriptFailure(['def Func(Ref: func(s: string))'], 'E475:')
 enddef
 
 " Default arg and varargs
diff --git a/src/version.c b/src/version.c
index 982ac1f..21cda47 100644
--- a/src/version.c
+++ b/src/version.c
@@ -747,6 +747,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    682,
+/**/
     681,
 /**/
     680,
diff --git a/src/vim9compile.c b/src/vim9compile.c
index 5644c50..eb84e35 100644
--- a/src/vim9compile.c
+++ b/src/vim9compile.c
@@ -1663,7 +1663,11 @@
 	++p;
 	while (*p != ')' && *p != NUL)
 	{
+	    char_u *sp = p;
+
 	    p = skip_type(p);
+	    if (p == sp)
+		return p;  // syntax error
 	    if (*p == ',')
 		p = skipwhite(p + 1);
 	}