diff --git a/mysql-test/main/func_kdf.result b/mysql-test/main/func_kdf.result
index fda8c0581d2cb..e334125c6d5f4 100644
--- a/mysql-test/main/func_kdf.result
+++ b/mysql-test/main/func_kdf.result
@@ -161,3 +161,25 @@ ERROR 42000: Incorrect parameter count in the call to native function 'kdf'
 #
 # End of 11.3 tests
 #
+#
+# MDEV-40385 use-of-uninitialized-value in Binary_string::c_ptr()
+#
+SELECT KDF('','',1000,256);
+KDF('','',1000,256)
+NULL
+Warnings:
+Warning	3047	Invalid argument error: '256' in function kdf.
+SELECT KDF('secret','salt',1000,999);
+KDF('secret','salt',1000,999)
+NULL
+Warnings:
+Warning	3047	Invalid argument error: '999' in function kdf.
+SELECT KDF('secret','salt',1000,'pbkdf2_hmac') IS NOT NULL;
+KDF('secret','salt',1000,'pbkdf2_hmac') IS NOT NULL
+1
+SELECT KDF('secret','salt') IS NOT NULL;
+KDF('secret','salt') IS NOT NULL
+1
+#
+# End of 11.4 tests
+#
diff --git a/mysql-test/main/func_kdf.test b/mysql-test/main/func_kdf.test
index 01f53da3c7ecd..279323ede5952 100644
--- a/mysql-test/main/func_kdf.test
+++ b/mysql-test/main/func_kdf.test
@@ -62,3 +62,17 @@ select kdf();
 --echo # End of 11.3 tests
 --echo #
 
+--echo #
+--echo # MDEV-40385 use-of-uninitialized-value in Binary_string::c_ptr()
+--echo #
+# MSAN only: this test verifies the fix behaviorally (warning + NULL); the
+# uninitialized read itself is only observable under an MSAN build.
+SELECT KDF('','',1000,256);
+SELECT KDF('secret','salt',1000,999);
+SELECT KDF('secret','salt',1000,'pbkdf2_hmac') IS NOT NULL;
+SELECT KDF('secret','salt') IS NOT NULL;
+
+--echo #
+--echo # End of 11.4 tests
+--echo #
+
diff --git a/sql/item_strfunc.cc b/sql/item_strfunc.cc
index f9bd32c111da4..30987598ed1e5 100644
--- a/sql/item_strfunc.cc
+++ b/sql/item_strfunc.cc
@@ -489,9 +489,9 @@ String *Item_func_kdf::val_str(String *buf)
   {
     if (String *s= args[3]->val_str(buf))
     {
-      if (strcasecmp(s->c_ptr(), "hkdf") == 0)
+      if (strcasecmp(s->c_ptr_safe(), "hkdf") == 0)
         use_hkdf= true;
-      else if (strcasecmp(s->c_ptr(), "pbkdf2_hmac") != 0)
+      else if (strcasecmp(s->c_ptr_safe(), "pbkdf2_hmac") != 0)
       {
         invalid_argument_error(func_name(), ErrConvStringQ(s).ptr());
         goto ret_null;