diff --git a/NEWS b/NEWS
index 1280b3977..7deccf3f4 100644
--- a/NEWS
+++ b/NEWS
@@ -23,3 +23,12 @@ Any uppercase BUG_* names are modernish shell bug IDs.
       case $n in
       ( [0-9] | "[0-9]")  echo "$n is a number or the number pattern" ;;
       esac
+  Ref.: https://github.com/att/ast/issues/476
+
+- Fix BUG_REDIRIO: ksh used to redirect standard output by default when no
+  file descriptor was specified with the rarely used '<>' reading/writing
+  redirection operator. It now redirects standard input by default, as POSIX
+  specifies and as all other POSIX shells do. To redirect standard output
+  for reading and writing, you now need '1<>'.
+  Ref.:	https://github.com/att/ast/issues/75
+	http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_07_07
diff --git a/TODO b/TODO
index b1242fffa..4de97417c 100644
--- a/TODO
+++ b/TODO
@@ -75,11 +75,5 @@ https://github.com/modernish/modernish/tree/0.16/lib/modernish/cap/
   on output. This means a script cannot check for them, and a script process
   in a pipe can get stuck in an infinite loop if SIGPIPE is ignored.
 
-- BUG_REDIRIO: the I/O redirection operator <> (open a file descriptor for
-  both read and write) defaults to opening standard output (i.e. is short
-  for 1<>) instead of defaulting to opening standard input (0<>) as POSIX
-  specifies[*].
-  [*] http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_07_07
-
 - BUG_TESTERR1A: test/[ exits with a non-error false status (1) if an
   invalid argument is given to an operator.
diff --git a/src/cmd/ksh93/sh.1 b/src/cmd/ksh93/sh.1
index fc9d69f02..3aadca961 100644
--- a/src/cmd/ksh93/sh.1
+++ b/src/cmd/ksh93/sh.1
@@ -3459,7 +3459,7 @@ otherwise, the file is created.
 Open file
 .I word\^
 for reading and writing
-as standard output.
+as standard input.
 .TP
 .BI <>; word
 The same as
diff --git a/src/cmd/ksh93/sh/lex.c b/src/cmd/ksh93/sh/lex.c
index f976ceda5..b6c504daf 100644
--- a/src/cmd/ksh93/sh/lex.c
+++ b/src/cmd/ksh93/sh/lex.c
@@ -599,7 +599,7 @@ int sh_lex(Lex_t* lp)
 						c  |= SYMPIPE;
 					else if(c=='<' && n=='>')
 					{
-						lp->digits = 1;
+						lp->digits = 0;
 						c = IORDWRSYM;
 						fcgetc(n);
 						if(fcgetc(n)==';')