diff --git a/src/regexp.c b/src/regexp.c
index 8e6e9c4..1bd1261 100644
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -1817,14 +1817,14 @@
  * call_func() by vim_regsub_both().
  */
     static int
-fill_submatch_list(int argc UNUSED, typval_T *argv, int argskip, int argcount)
+fill_submatch_list(int argc UNUSED, typval_T *argv, int argskip, ufunc_T *fp)
 {
     listitem_T	*li;
     int		i;
     char_u	*s;
     typval_T	*listarg = argv + argskip;
 
-    if (argcount == argskip)
+    if (!fp->uf_varargs && fp->uf_args.ga_len <= argskip)
 	// called function doesn't take a submatches argument
 	return argskip;
 
diff --git a/src/structs.h b/src/structs.h
index 581b22e..be08f0a 100644
--- a/src/structs.h
+++ b/src/structs.h
@@ -2052,13 +2052,13 @@
 
 // Struct passed between functions dealing with function call execution.
 //
-// "argv_func", when not NULL, can be used to fill in arguments only when the
+// "fe_argv_func", when not NULL, can be used to fill in arguments only when the
 // invoked function uses them.  It is called like this:
-//   new_argcount = argv_func(current_argcount, argv, partial_argcount,
-//							called_func_argcount)
+//   new_argcount = fe_argv_func(current_argcount, argv, partial_argcount,
+//							called_func)
 //
 typedef struct {
-    int		(* fe_argv_func)(int, typval_T *, int, int);
+    int		(* fe_argv_func)(int, typval_T *, int, ufunc_T *);
     linenr_T	fe_firstline;	// first line of range
     linenr_T	fe_lastline;	// last line of range
     int		*fe_doesrange;	// if not NULL: return: function handled range
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index 92e86a9..af450d5 100644
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -439,20 +439,24 @@
 func SubReplacer(text, submatches)
   return a:text .. a:submatches[0] .. a:text
 endfunc
+func SubReplacerVar(text, ...)
+  return a:text .. a:1[0] .. a:text
+endfunc
 func SubReplacer20(t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15, t16, t17, t18, t19, submatches)
   return a:t3 .. a:submatches[0] .. a:t11
 endfunc
 
 func Test_substitute_partial()
-   call assert_equal('1foo2foo3', substitute('123', '2', function('SubReplacer', ['foo']), 'g'))
+  call assert_equal('1foo2foo3', substitute('123', '2', function('SubReplacer', ['foo']), 'g'))
+  call assert_equal('1foo2foo3', substitute('123', '2', function('SubReplacerVar', ['foo']), 'g'))
 
-   " 19 arguments plus one is just OK
-   let Replacer = function('SubReplacer20', repeat(['foo'], 19))
-   call assert_equal('1foo2foo3', substitute('123', '2', Replacer, 'g'))
+  " 19 arguments plus one is just OK
+  let Replacer = function('SubReplacer20', repeat(['foo'], 19))
+  call assert_equal('1foo2foo3', substitute('123', '2', Replacer, 'g'))
 
-   " 20 arguments plus one is too many
-   let Replacer = function('SubReplacer20', repeat(['foo'], 20))
-   call assert_fails("call substitute('123', '2', Replacer, 'g')", 'E118:')
+  " 20 arguments plus one is too many
+  let Replacer = function('SubReplacer20', repeat(['foo'], 20))
+  call assert_fails("call substitute('123', '2', Replacer, 'g')", 'E118:')
 endfunc
 
 func Test_substitute_float()
diff --git a/src/userfunc.c b/src/userfunc.c
index 1412caa..35ce3f3 100644
--- a/src/userfunc.c
+++ b/src/userfunc.c
@@ -3644,7 +3644,7 @@
 		if (funcexe->fe_argv_func != NULL)
 		    // postponed filling in the arguments, do it now
 		    argcount = funcexe->fe_argv_func(argcount, argvars,
-					       argv_clear, fp->uf_args.ga_len);
+					       argv_clear, fp);
 
 		if (funcexe->fe_basetv != NULL)
 		{
diff --git a/src/version.c b/src/version.c
index ae74081..77db155 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    476,
+/**/
     475,
 /**/
     474,