diff --git a/NEWS.md b/NEWS.md
index 993c28fccc..f0747cc220 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -6,6 +6,9 @@
 
 1. Using `print.data.table()` with character truncation using `datatable.prettyprint.char` no longer errors with `NA` entries, [#6441](https://github.com/Rdatatable/data.table/issues/6441). Thanks to @r2evans for the bug report, and @joshhwuu for the fix.
 
+
+2. Fixed a segfault in `fcase()`, [#6448](https://github.com/Rdatatable/data.table/issues/6448). Thanks @ethanbsmith for reporting with reprex, @aitap for finding the root cause, and @MichaelChirico for the PR.
+
 ## NOTES
 
 1. Fixed a typo in the NEWS for the last release -- that's version 1.16.0, not 1.6.0; apologies. Thanks @r2evans for flagging, [#6443](https://github.com/Rdatatable/data.table/issues/6443).
diff --git a/inst/tests/tests.Rraw b/inst/tests/tests.Rraw
index ff213bfdfb..98fe107452 100644
--- a/inst/tests/tests.Rraw
+++ b/inst/tests/tests.Rraw
@@ -19042,3 +19042,14 @@ test(2278.3, set(copy(dt), 0L,          "b", NA),         copy(dt)[0L, b := NA])
 test(2278.4, set(copy(dt), NA_integer_, "b", logical(0)), copy(dt)[NA_integer_, b := logical(0)])
 test(2278.5, set(copy(dt), integer(0),  "b", numeric(0)), copy(dt)[integer(0),  b := numeric(0)])
 test(2278.6, { set(dt, 0L, "b", logical(0)); set(dt, 1L, "a", 2L); dt }, data.table(a=2L, b=NA))
+
+# ensure proper PROTECT() within fcase, #6448
+x <- 1:3
+test(2279,
+     fcase(
+       x<2, structure(list(1), class = "foo"),
+       x<3, structure(list(2), class = "foo"),
+       # Force gc() and some allocations which have a good chance at landing in the region that was earlier left unprotected
+       { gc(full = TRUE); replicate(10, FALSE); x<4 },
+       `attr<-`(list(3), "class", "foo")),
+     structure(list(1, 2, 3), class = "foo"))
diff --git a/src/fifelse.c b/src/fifelse.c
index bd28e88ad0..f117214d1d 100644
--- a/src/fifelse.c
+++ b/src/fifelse.c
@@ -209,14 +209,16 @@ SEXP fcaseR(SEXP rho, SEXP args) {
             "Note that the default argument must be named explicitly, e.g., default=0"), narg - 2);
   }
   int nprotect=0, l;
-  int64_t len0=0, len1=0, len2=0;
-  SEXP ans=R_NilValue, value0=R_NilValue, tracker=R_NilValue, whens=R_NilValue, thens=R_NilValue;
+  int64_t n_ans=0, n_this_arg=0, n_undecided=0;
+  SEXP ans=R_NilValue, tracker=R_NilValue, whens=R_NilValue, thens=R_NilValue;
+  SEXP ans_class, ans_levels;
   PROTECT_INDEX Iwhens, Ithens;
   PROTECT_WITH_INDEX(whens, &Iwhens); nprotect++;
   PROTECT_WITH_INDEX(thens, &Ithens); nprotect++;
-  SEXPTYPE type0=NILSXP;
+  SEXPTYPE ans_type=NILSXP;
   // naout means if the output is scalar logic na
   bool imask = true, naout = false, idefault = false;
+  bool ans_is_factor;
   int *restrict p = NULL;
   const int n = narg/2;
   for (int i=0; i<n; ++i) {
@@ -232,35 +234,39 @@ SEXP fcaseR(SEXP rho, SEXP args) {
     const int *restrict pwhens = LOGICAL(whens);
     l = 0;
     if (i == 0) {
-      len0 = xlength(whens);
-      len2 = len0;
-      type0 = TYPEOF(thens);
-      value0 = thens;
-      ans = PROTECT(allocVector(type0, len0)); nprotect++;
+      n_ans = xlength(whens);
+      n_undecided = n_ans;
+      ans_type = TYPEOF(thens);
+      ans_class = PROTECT(getAttrib(thens, R_ClassSymbol)); nprotect++;
+      ans_is_factor = isFactor(thens);
+      if (ans_is_factor) {
+        ans_levels = PROTECT(getAttrib(thens, R_LevelsSymbol)); nprotect++;
+      }
+      ans = PROTECT(allocVector(ans_type, n_ans)); nprotect++;
       copyMostAttrib(thens, ans);
-      tracker = PROTECT(allocVector(INTSXP, len0)); nprotect++;
+      tracker = PROTECT(allocVector(INTSXP, n_ans)); nprotect++;
       p = INTEGER(tracker);     
     } else {
       imask = false;
       naout = xlength(thens) == 1 && TYPEOF(thens) == LGLSXP && LOGICAL(thens)[0]==NA_LOGICAL;
-      if (xlength(whens) != len0) {
+      if (xlength(whens) != n_ans) {
         // no need to check `idefault` here because the con for default is always `TRUE`
         error(_("Argument #%d has length %lld which differs from that of argument #1 (%lld). "
                 "Please make sure all logical conditions have the same length."),
-                i*2+1, (long long)xlength(whens), (long long)len0);
+                i*2+1, (long long)xlength(whens), (long long)n_ans);
       }
-      if (!naout && TYPEOF(thens) != type0) {
+      if (!naout && TYPEOF(thens) != ans_type) {
         if (idefault) {
           error(_("Resulting value is of type %s but 'default' is of type %s. "
-                  "Please make sure that both arguments have the same type."), type2char(type0), type2char(TYPEOF(thens)));
+                  "Please make sure that both arguments have the same type."), type2char(ans_type), type2char(TYPEOF(thens)));
         } else {
           error(_("Argument #%d is of type %s, however argument #2 is of type %s. "
                   "Please make sure all output values have the same type."),
-                  i*2+2, type2char(TYPEOF(thens)), type2char(type0));
+                  i*2+2, type2char(TYPEOF(thens)), type2char(ans_type));
         }
       }
       if (!naout) {
-        if (!R_compute_identical(PROTECT(getAttrib(value0, R_ClassSymbol)),  PROTECT(getAttrib(thens, R_ClassSymbol)), 0)) {
+        if (!R_compute_identical(ans_class,  PROTECT(getAttrib(thens, R_ClassSymbol)), 0)) {
           if (idefault) {
             error(_("Resulting value has different class than 'default'. "
                     "Please make sure that both arguments have the same class."));
@@ -269,35 +275,35 @@ SEXP fcaseR(SEXP rho, SEXP args) {
                     "Please make sure all output values have the same class."), i*2+2);
           }
         }
-        UNPROTECT(2); // class(value0), class(thens)
+        UNPROTECT(1); // class(thens)
       }
-      if (!naout && isFactor(value0)) {
-        if (!R_compute_identical(PROTECT(getAttrib(value0, R_LevelsSymbol)),  PROTECT(getAttrib(thens, R_LevelsSymbol)), 0)) {
+      if (!naout && ans_is_factor) {
+        if (!R_compute_identical(ans_levels,  PROTECT(getAttrib(thens, R_LevelsSymbol)), 0)) {
           if (idefault) {
             error(_("Resulting value and 'default' are both type factor but their levels are different."));
           } else {
             error(_("Argument #2 and argument #%d are both factor but their levels are different."), i*2+2);
           }
         }
-        UNPROTECT(2); // levels(value0), levels(thens)
+        UNPROTECT(1); // levels(thens)
       }
     }
-    len1 = xlength(thens);
-    if (len1 != len0 && len1 != 1) {
+    n_this_arg = xlength(thens);
+    if (n_this_arg != n_ans && n_this_arg != 1) {
       if (idefault) {
-        error(_("Length of 'default' must be 1 or %lld."), (long long)len0);
+        error(_("Length of 'default' must be 1 or %lld."), (long long)n_ans);
       } else {
-        error(_("Length of output value #%d (%lld) must either be 1 or match the length of the logical condition (%lld)."), i*2+2, (long long)len1, (long long)len0);
+        error(_("Length of output value #%d (%lld) must either be 1 or match the length of the logical condition (%lld)."), i*2+2, (long long)n_this_arg, (long long)n_ans);
       }
     }
-    int64_t thenMask = len1>1 ? INT64_MAX : 0;
+    int64_t thenMask = n_this_arg>1 ? INT64_MAX : 0;
     switch(TYPEOF(ans)) {
     case LGLSXP: {
       const int *restrict pthens;
       if (!naout) pthens = LOGICAL(thens); // the content is not useful if out is NA_LOGICAL scalar
       int *restrict pans = LOGICAL(ans);
       const int pna = NA_LOGICAL;
-      for (int64_t j=0; j<len2; ++j) {
+      for (int64_t j=0; j<n_undecided; ++j) {
         const int64_t idx = imask ? j : p[j];
         if (pwhens[idx]==1) {
           pans[idx] = naout ? pna : pthens[idx & thenMask];
@@ -314,7 +320,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
       if (!naout) pthens = INTEGER(thens); // the content is not useful if out is NA_LOGICAL scalar
       int *restrict pans = INTEGER(ans);
       const int pna = NA_INTEGER;
-      for (int64_t j=0; j<len2; ++j) {
+      for (int64_t j=0; j<n_undecided; ++j) {
         const int64_t idx = imask ? j : p[j];
         if (pwhens[idx]==1) {
           pans[idx] = naout ? pna : pthens[idx & thenMask];
@@ -332,7 +338,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
       double *restrict pans = REAL(ans);
       const double na_double = INHERITS(ans, char_integer64) ? NA_INT64_D : NA_REAL;
       const double pna = na_double;
-      for (int64_t j=0; j<len2; ++j) {
+      for (int64_t j=0; j<n_undecided; ++j) {
         const int64_t idx = imask ? j : p[j];
         if (pwhens[idx]==1) {
           pans[idx] = naout ? pna : pthens[idx & thenMask];
@@ -349,7 +355,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
       if (!naout) pthens = COMPLEX(thens); // the content is not useful if out is NA_LOGICAL scalar
       Rcomplex *restrict pans = COMPLEX(ans);
       const Rcomplex pna = NA_CPLX;
-      for (int64_t j=0; j<len2; ++j) {
+      for (int64_t j=0; j<n_undecided; ++j) {
         const int64_t idx = imask ? j : p[j];
         if (pwhens[idx]==1) {
           pans[idx] = naout ? pna : pthens[idx & thenMask];
@@ -365,7 +371,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
       const SEXP *restrict pthens;
       if (!naout) pthens = STRING_PTR_RO(thens); // the content is not useful if out is NA_LOGICAL scalar
       const SEXP pna = NA_STRING;
-      for (int64_t j=0; j<len2; ++j) {
+      for (int64_t j=0; j<n_undecided; ++j) {
         const int64_t idx = imask ? j : p[j];
         if (pwhens[idx]==1) {
           SET_STRING_ELT(ans, idx, naout ? pna : pthens[idx & thenMask]);
@@ -382,7 +388,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
       // assign the NA values as it does for other atomic types
       const SEXP *restrict pthens;
       if (!naout) pthens = SEXPPTR_RO(thens); // the content is not useful if out is NA_LOGICAL scalar
-      for (int64_t j=0; j<len2; ++j) {
+      for (int64_t j=0; j<n_undecided; ++j) {
         const int64_t idx = imask ? j : p[j];
         if (pwhens[idx]==1) {
           if (!naout) SET_VECTOR_ELT(ans, idx, pthens[idx & thenMask]);
@@ -397,7 +403,7 @@ SEXP fcaseR(SEXP rho, SEXP args) {
     if (l==0) {
       break;  // stop early as nothing left to do
     }
-    len2 = l;
+    n_undecided = l;
   }
   UNPROTECT(nprotect); // whens, thens, ans, tracker
   return ans;