diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index fc692e3..a7f80a8 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -3947,6 +3947,11 @@
 		    VIM_CLEAR(sub_firstline);
 		}
 
+		// Match might be after the last line for "\n\zs" matching at
+		// the end of the last line.
+		if (lnum > curbuf->b_ml.ml_line_count)
+		    break;
+
 		if (sub_firstline == NULL)
 		{
 		    sub_firstline = vim_strsave(ml_get(sub_firstlnum));
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
index 8a8e7ab..e8b0e49 100644
--- a/src/testdir/test_substitute.vim
+++ b/src/testdir/test_substitute.vim
@@ -413,6 +413,7 @@
   for t in a:tests
     let start = line('.') + 1
     let end = start + len(t[2]) - 1
+    " TODO: why is there a one second delay the first time we get here?
     exe "normal o" . t[0]
     call cursor(start, 1)
     exe t[1]
@@ -716,3 +717,12 @@
 
   close!
 endfunc
+
+func Test_sub_beyond_end()
+  new
+  call setline(1, '#')
+  let @/ = '^#\n\zs'
+  s///e
+  call assert_equal('#', getline(1))
+  bwipe!
+endfunc
diff --git a/src/version.c b/src/version.c
index e8e2806..9766d65 100644
--- a/src/version.c
+++ b/src/version.c
@@ -742,6 +742,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    2236,
+/**/
     2235,
 /**/
     2234,