diff --git a/bin/tests/system/tcp/tests_tcp.py b/bin/tests/system/tcp/tests_tcp.py
index 532b47b958..f6161946ff 100644
--- a/bin/tests/system/tcp/tests_tcp.py
+++ b/bin/tests/system/tcp/tests_tcp.py
@@ -114,3 +114,21 @@ def test_close_wait(named_port):
         msg = create_msg("a.example.", "A")
         (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
         (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+
+# GL #4273
+def test_tcp_big(named_port):
+    with create_socket("10.53.0.7", named_port) as sock:
+        msg = dns.message.Message(id=0)
+        msg.flags = dns.flags.RD
+        msg.question.append(dns.rrset.from_text(dns.name.root, 0, 1, "URI"))
+        msg.additional.append(
+            dns.rrset.from_text(dns.name.root, 0, 1, "URI", "0 0 " + "b" * 65503)
+        )
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
+
+        # Now check that the server is alive and well
+        msg = create_msg("a.example.", "A")
+        (sbytes, stime) = dns.query.send_tcp(sock, msg, timeout())
+        (response, rtime) = dns.query.receive_tcp(sock, timeout())
diff --git a/lib/isc/include/isc/dnsstream.h b/lib/isc/include/isc/dnsstream.h
index 1e6a26b086..472cf22dd3 100644
--- a/lib/isc/include/isc/dnsstream.h
+++ b/lib/isc/include/isc/dnsstream.h
@@ -491,13 +491,9 @@ isc_dnsstream_assembler_incoming(isc_dnsstream_assembler_t *restrict dnsasm,
 	REQUIRE(dnsasm != NULL);
 	INSIST(!dnsasm->calling_cb);
 
-	if (buf_size == 0) {
-		INSIST(buf == NULL);
-	} else {
+	if (buf != NULL && buf_size > 0) {
 		size_t remaining;
 
-		INSIST(buf != NULL);
-
 		remaining = isc_buffer_remaininglength(&dnsasm->dnsbuf);
 
 		if (remaining == 0) {
@@ -525,7 +521,7 @@ isc_dnsstream_assembler_incoming(isc_dnsstream_assembler_t *restrict dnsasm,
 			 * when receiving the next batch of data.
 			 */
 			return;
-		} else if (remaining == 1 && buf_size > 0) {
+		} else if (remaining == 1) {
 			/* Mostly the same case as above, but we have incomplete
 			 * message length in the buffer and received at least
 			 * one byte to complete it.
@@ -544,7 +540,7 @@ isc_dnsstream_assembler_incoming(isc_dnsstream_assembler_t *restrict dnsasm,
 				return;
 			}
 
-			if (buf_size > 0) {
+			if (unprocessed_size > 0) {
 				isc_buffer_putmem(dnsasm->current,
 						  unprocessed_buf,
 						  unprocessed_size);