diff --git a/src/bin/psql/command.c b/src/bin/psql/command.c
index 2e55c900aa1..f5ea75e223d 100644
--- a/src/bin/psql/command.c
+++ b/src/bin/psql/command.c
@@ -2007,7 +2007,7 @@ exec_command_lo(PsqlScanState scan_state, bool active_branch, const char *cmd)
 
 		if (strcmp(cmd + 3, "export") == 0)
 		{
-			if (!opt2)
+			if (!opt1 || !opt2)
 			{
 				pg_log_error("\\%s: missing required argument", cmd);
 				success = false;
diff --git a/src/bin/psql/psqlscanslash.l b/src/bin/psql/psqlscanslash.l
index 27782eedcad..4a07a154e89 100644
--- a/src/bin/psql/psqlscanslash.l
+++ b/src/bin/psql/psqlscanslash.l
@@ -536,7 +536,8 @@ psql_scan_slash_command(PsqlScanState state)
 
 /*
  * Parse off the next argument for a backslash command, and return it as a
- * malloc'd string.  If there are no more arguments, returns NULL.
+ * malloc'd string.  If there are no more arguments or on out-of-memory,
+ * returns NULL.
  *
  * type tells what processing, if any, to perform on the option string;
  * for example, if it's a SQL identifier, we want to downcase any unquoted
@@ -613,6 +614,16 @@ psql_scan_slash_option(PsqlScanState state,
 	 */
 	Assert(lexresult == LEXRES_EOL || lexresult == LEXRES_OK);
 
+	/*
+	 * yylex() appends option text to mybuf, so a buffer enlargement failure
+	 * during lexing can leave mybuf broken even if initialization succeeded.
+	 */
+	if (PQExpBufferDataBroken(mybuf))
+	{
+		pg_log_error("out of memory");
+		return NULL;
+	}
+
 	switch (final_state)
 	{
 		case xslashargstart:
@@ -821,7 +832,7 @@ static void
 evaluate_backtick(PsqlScanState state)
 {
 	PQExpBuffer output_buf = state->output_buf;
-	char	   *cmd = output_buf->data + backtick_start_offset;
+	char	   *cmd;
 	PQExpBufferData cmd_output;
 	FILE	   *fd;
 	bool		error = false;
@@ -829,6 +840,15 @@ evaluate_backtick(PsqlScanState state)
 	char		buf[512];
 	size_t		result;
 
+	/*
+	 * The option buffer is already broken; avoid touching the static
+	 * oom_buffer and let psql_scan_slash_option() return NULL.
+	 */
+	if (PQExpBufferBroken(output_buf))
+		return;
+
+	cmd = output_buf->data + backtick_start_offset;
+
 	initPQExpBuffer(&cmd_output);
 
 	fflush(NULL);