diff --git a/os/kernel/src/chmboxes.c b/os/kernel/src/chmboxes.c
index 86f88dce7..163f93f20 100644
--- a/os/kernel/src/chmboxes.c
+++ b/os/kernel/src/chmboxes.c
@@ -364,6 +364,7 @@ msg_t chMBFetchI(Mailbox *mbp, msg_t *msgp) {
 
   if (chSemGetCounterI(&mbp->mb_fullsem) <= 0)
     return RDY_TIMEOUT;
+  chSemFastWaitI(&mbp->mb_fullsem);
   *msgp = *mbp->mb_rdptr++;
   if (mbp->mb_rdptr >= mbp->mb_top)
     mbp->mb_rdptr = mbp->mb_buffer;
diff --git a/readme.txt b/readme.txt
index a27ef1fe6..d12fe1727 100644
--- a/readme.txt
+++ b/readme.txt
@@ -79,6 +79,8 @@
 *****************************************************************************
 
 *** 2.5.0 ***
+- FIX: Fixed chMBFetchI does not decrement mb_fullsem (bug 3504450)(backported
+  to 2.2.9 and 2.4.1).
 - FIX: Fixed USART3 not working on STM32F2/F4 UART driver (bug 3496981)
   (backported to 2.4.1).
 - FIX: Fixed stack misalignment on Posix-MacOSX (bug 3495487)(backported
diff --git a/test/testmbox.c b/test/testmbox.c
index 5271752d2..544bc29ae 100644
--- a/test/testmbox.c
+++ b/test/testmbox.c
@@ -180,30 +180,34 @@ static void mbox1_execute(void) {
     test_emit_token(msg2);
   }
   test_assert_sequence(29, "ABCDE");
-  test_assert(30, mb1.mb_rdptr == mb1.mb_wrptr, "pointers not aligned");
+  test_assert_lock(30, chMBGetFreeCountI(&mb1) == MB_SIZE, "not empty");
+  test_assert_lock(31, chMBGetUsedCountI(&mb1) == 0, "still full");
+  test_assert(32, mb1.mb_rdptr == mb1.mb_wrptr, "pointers not aligned");
 
   chSysLock();
   msg1 = chMBPostAheadI(&mb1, 'E');
-  test_assert(31, msg1 == RDY_OK, "wrong wake-up message");
-  msg1 = chMBPostAheadI(&mb1, 'D');
-  test_assert(32, msg1 == RDY_OK, "wrong wake-up message");
-  msg1 = chMBPostAheadI(&mb1, 'C');
   test_assert(33, msg1 == RDY_OK, "wrong wake-up message");
-  msg1 = chMBPostAheadI(&mb1, 'B');
+  msg1 = chMBPostAheadI(&mb1, 'D');
   test_assert(34, msg1 == RDY_OK, "wrong wake-up message");
+  msg1 = chMBPostAheadI(&mb1, 'C');
+  test_assert(35, msg1 == RDY_OK, "wrong wake-up message");
+  msg1 = chMBPostAheadI(&mb1, 'B');
+  test_assert(36, msg1 == RDY_OK, "wrong wake-up message");
   msg1 = chMBPostAheadI(&mb1, 'A');
   chSysUnlock();
-  test_assert(35, msg1 == RDY_OK, "wrong wake-up message");
-  test_assert(36, mb1.mb_rdptr == mb1.mb_wrptr, "pointers not aligned");
+  test_assert(37, msg1 == RDY_OK, "wrong wake-up message");
+  test_assert(38, mb1.mb_rdptr == mb1.mb_wrptr, "pointers not aligned");
   for (i = 0; i < MB_SIZE; i++) {
     chSysLock();
     msg1 = chMBFetchI(&mb1, &msg2);
     chSysUnlock();
-    test_assert(37, msg1 == RDY_OK, "wrong wake-up message");
+    test_assert(39, msg1 == RDY_OK, "wrong wake-up message");
     test_emit_token(msg2);
   }
   test_assert_sequence(38, "ABCDE");
-  test_assert(39, mb1.mb_rdptr == mb1.mb_wrptr, "pointers not aligned");
+  test_assert_lock(39, chMBGetFreeCountI(&mb1) == MB_SIZE, "not empty");
+  test_assert_lock(40, chMBGetUsedCountI(&mb1) == 0, "still full");
+  test_assert(41, mb1.mb_rdptr == mb1.mb_wrptr, "pointers not aligned");
 
   /*
    * Testing reset.
@@ -213,10 +217,10 @@ static void mbox1_execute(void) {
   /*
    * Re-testing final conditions.
    */
-  test_assert_lock(40, chMBGetFreeCountI(&mb1) == MB_SIZE, "not empty");
-  test_assert_lock(41, chMBGetUsedCountI(&mb1) == 0, "still full");
-  test_assert_lock(42, mb1.mb_buffer == mb1.mb_wrptr, "write pointer not aligned to base");
-  test_assert_lock(43, mb1.mb_buffer == mb1.mb_rdptr, "read pointer not aligned to base");
+  test_assert_lock(42, chMBGetFreeCountI(&mb1) == MB_SIZE, "not empty");
+  test_assert_lock(43, chMBGetUsedCountI(&mb1) == 0, "still full");
+  test_assert_lock(44, mb1.mb_buffer == mb1.mb_wrptr, "write pointer not aligned to base");
+  test_assert_lock(45, mb1.mb_buffer == mb1.mb_rdptr, "read pointer not aligned to base");
 }
 
 ROMCONST struct testcase testmbox1 = {