diff --git a/src/lib/libc/stdlib/malloc.3 b/src/lib/libc/stdlib/malloc.3
index 42cf9ba9..c65c08ef 100644
--- a/src/lib/libc/stdlib/malloc.3
+++ b/src/lib/libc/stdlib/malloc.3
@@ -30,9 +30,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"	$OpenBSD: malloc.3,v 1.108 2017/03/29 17:38:37 otto Exp $
+.\"	$OpenBSD: malloc.3,v 1.109 2017/04/06 17:00:52 otto Exp $
 .\"
-.Dd $Mdocdate: March 29 2017 $
+.Dd $Mdocdate: April 6 2017 $
 .Dt MALLOC 3
 .Os
 .Sh NAME
@@ -177,9 +177,9 @@ is set to
 .Er ENOMEM .
 .Pp
 If
-.Fa size
-or
 .Fa nmemb
+or
+.Fa size
 is equal to 0, a unique pointer to an access protected,
 zero sized object is returned.
 Access via this pointer will generate a
@@ -346,7 +346,7 @@ size_t num, size;
 if (size && num > SIZE_MAX / size)
 	errc(1, EOVERFLOW, "overflow");
 
-if ((p = malloc(size * num)) == NULL)
+if ((p = malloc(num * size)) == NULL)
 	err(1, NULL);
 .Ed
 .Pp
@@ -364,7 +364,7 @@ if (size < 0 || num < 0)
 if (size && num > INT_MAX / size)
 	errc(1, EOVERFLOW, "overflow");
 
-if ((p = malloc(size * num)) == NULL)
+if ((p = malloc(num * size)) == NULL)
 	err(1, NULL);
 .Ed
 .Pp
@@ -471,9 +471,9 @@ functions conform to
 .St -ansiC .
 .Pp
 If
-.Fa size
-or
 .Fa nmemb
+or
+.Fa size
 are 0, the return value is implementation defined;
 other conforming implementations may return
 .Dv NULL