diff --git a/crypto/bn/bn_tests.txt b/crypto/bn/bn_tests.txt
index 2c09520..8451fcf 100644
--- a/crypto/bn/bn_tests.txt
+++ b/crypto/bn/bn_tests.txt
@@ -9880,6 +9880,41 @@
 #
 # These test vectors satisfy A ^ E = ModExp (mod M) and 0 <= ModExp < M.
 
+ModExp = 00
+A = -01
+E = 01
+M = 01
+
+ModExp = 01
+A = -02
+E = 01
+M = 03
+
+ModExp = 01
+A = -01
+E = 02
+M = 03
+
+ModExp = 01
+A = -02
+E = 02
+M = 03
+
+ModExp = 00
+A = -03
+E = 02
+M = 03
+
+ModExp = 02
+A = -04
+E = 01
+M = 03
+
+ModExp = 01
+A = -04
+E = 02
+M = 03
+
 # Regression test for carry propagation bug in sqr8x_reduction.
 ModExp = 19324b647d967d644b3219
 A = 050505050505
diff --git a/crypto/bn/exponentiation.c b/crypto/bn/exponentiation.c
index eedc88e..2d68808 100644
--- a/crypto/bn/exponentiation.c
+++ b/crypto/bn/exponentiation.c
@@ -992,7 +992,7 @@
 
   /* prepare a^1 in Montgomery domain */
   if (a->neg || BN_ucmp(a, m) >= 0) {
-    if (!BN_mod(&am, a, m, ctx) ||
+    if (!BN_nnmod(&am, a, m, ctx) ||
         !BN_to_montgomery(&am, &am, mont, ctx)) {
       goto err;
     }