diff -urp mksh.orig/check.t mksh/check.t
--- mksh.orig/check.t	2016-08-12 16:48:28.000000000 +0000
+++ mksh/check.t	2016-08-18 06:51:31.069554000 +0000
@@ -2274,7 +2274,7 @@ expected-stdout:
 	cbc
 	-bc cbc
 	abc bbc
-	^bc abc bbc
+	!bc -bc ^bc cbc
 	!bc -bc ^bc cbc
 ---
 name: glob-range-2
diff -urp mksh.orig/eval.c mksh/eval.c
--- mksh.orig/eval.c	2016-08-01 21:38:27.000000000 +0000
+++ mksh/eval.c	2016-08-18 06:51:31.063554000 +0000
@@ -972,6 +972,7 @@ expand(
 				switch (c) {
 				case '[':
 				case '!':
+				case NOT2:
 				case '-':
 				case ']':
 					/*
diff -urp mksh.orig/misc.c mksh/misc.c
--- mksh.orig/misc.c	2016-08-01 18:43:08.000000000 +0000
+++ mksh/misc.c	2016-08-18 06:51:31.064554000 +0000
@@ -902,7 +902,7 @@ gmatch_cclass(const unsigned char *p, un
 	bool notp, found = false;
 	const unsigned char *orig_p = p;
 
-	if ((notp = tobool(ISMAGIC(*p) && *++p == '!')))
+	if ((notp = tobool(ISMAGIC(*p) && (*++p == '!' || *p == NOT2))))
 		p++;
 	do {
 		c = *p++;
diff -urp mksh.orig/sh.h mksh/sh.h
--- mksh.orig/sh.h	2016-08-12 16:48:31.000000000 +0000
+++ mksh/sh.h	2016-08-18 06:51:31.066554000 +0000
@@ -501,6 +501,7 @@ extern int __cdecl setegid(gid_t);
  */
 #define MAGIC		(7)	/* prefix for *?[!{,} during expand */
 #define ISMAGIC(c)	((unsigned char)(c) == MAGIC)
+#define NOT2		'^'
 
 EXTERN const char *safe_prompt; /* safe prompt if PS1 substitution fails */