diff --git a/CHANGES b/CHANGES
index 18820e0b47..748fe8afb5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+6084.	[bug]		When BIND was built without jemalloc, the allocator flag
+			ISC_MEM_ZERO could return non-zero memory. [GL #3845]
+
 6083.	[bug]		Fix DNSRPS-enabled builds as they were inadvertently
 			broken by changes 5949 and 6042. [GL #3827]
 
diff --git a/lib/isc/jemalloc_shim.h b/lib/isc/jemalloc_shim.h
index f01e256b09..0edb09267d 100644
--- a/lib/isc/jemalloc_shim.h
+++ b/lib/isc/jemalloc_shim.h
@@ -66,7 +66,7 @@ mallocx(size_t size, int flags) {
 	INSIST(ptr != NULL);
 
 	if ((flags & MALLOCX_ZERO) != 0) {
-		memset(ptr, 0, size);
+		memset(ptr, 0, sallocx(ptr, flags));
 	}
 
 	return (ptr);
@@ -83,7 +83,7 @@ sdallocx(void *ptr, size_t size, int flags) {
 static inline void *
 rallocx(void *ptr, size_t size, int flags) {
 	void *new_ptr;
-	size_t old_size;
+	size_t old_size, new_size;
 
 	REQUIRE(size != 0);
 
@@ -94,8 +94,12 @@ rallocx(void *ptr, size_t size, int flags) {
 	new_ptr = realloc(ptr, size);
 	INSIST(new_ptr != NULL);
 
-	if ((flags & MALLOCX_ZERO) != 0 && size > old_size) {
-		memset((uint8_t *)new_ptr + old_size, 0, size - old_size);
+	if ((flags & MALLOCX_ZERO) != 0) {
+		new_size = sallocx(new_ptr, flags);
+		if (new_size > old_size) {
+			memset((uint8_t *)new_ptr + old_size, 0,
+			       new_size - old_size);
+		}
 	}
 
 	return (new_ptr);