diff --git a/CHANGES b/CHANGES
index 0a50cfc42e..7f2e159c78 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2869.	[bug]		Fix arguments to dns_keytable_findnextkeynode() call.
+			[RT #20877]
+
 2868.	[cleanup]	Run "make clean" at the end of configure to ensure
 			any changes made by configure are integrated.
 			Use --with-make-clean=no to disable.  [RT #20994]
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index fb3c5b5df8..8227c77010 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.187 2010/03/04 23:50:34 tbox Exp $ */
+/* $Id: validator.c,v 1.188 2010/03/26 17:12:48 marka Exp $ */
 
 #include <config.h>
 
@@ -2211,7 +2211,7 @@ validatezonekey(dns_validator_t *val) {
 		     result == ISC_R_SUCCESS;
 		     result = dns_rdataset_next(val->event->sigrdataset))
 		{
-			dns_keynode_t *keynode = NULL, *nextnode = NULL;
+			dns_keynode_t *keynode = NULL;
 
 			dns_rdata_reset(&sigrdata);
 			dns_rdataset_current(val->event->sigrdataset,
@@ -2231,6 +2231,7 @@ validatezonekey(dns_validator_t *val) {
 			    result == ISC_R_SUCCESS)
 				atsep = ISC_TRUE;
 			while (result == ISC_R_SUCCESS) {
+				dns_keynode_t *nextnode = NULL;
 				dstkey = dns_keynode_key(keynode);
 				if (dstkey == NULL) {
 					dns_keytable_detachkeynode(