diff --git a/core/coreunix/add.go b/core/coreunix/add.go
index 8539bf108..492533530 100644
--- a/core/coreunix/add.go
+++ b/core/coreunix/add.go
@@ -223,6 +223,11 @@ func (adder *Adder) Finalize() (node.Node, error) {
 		if err != nil {
 			return nil, err
 		}
+
+		if len(children) == 0 {
+			return nil, fmt.Errorf("expected at least one child dir, got none")
+		}
+
 		name = children[0]
 
 		mr, err := adder.mfsRoot()
diff --git a/test/sharness/t0600-issues-and-regressions-online.sh b/test/sharness/t0600-issues-and-regressions-online.sh
index 13964ce34..b7953d57e 100755
--- a/test/sharness/t0600-issues-and-regressions-online.sh
+++ b/test/sharness/t0600-issues-and-regressions-online.sh
@@ -46,6 +46,11 @@ test_expect_success "pin add api looks right - #3753" '
 	test_cmp pinrm_out pinrm_exp
 '
 
+test_expect_success "no daemon crash on improper file argument - #4003" '
+    FNC=$(echo $API_ADDR | awk -F: '\''{ printf "%s %s", $1, $2 }'\'') &&
+    echo -n "POST /api/v0/add?pin=true HTTP/1.1\r\nHost: $API_ADDR\r\nContent-Type: multipart/form-data; boundary=Pyw9xQLtiLPE6XcI\r\nContent-Length: 22\r\n\r\n\r\n--Pyw9xQLtiLPE6XcI\r\n" | nc -v $FNC | grep "200 OK"
+'
+
 test_kill_ipfs_daemon
 
 test_expect_success "ipfs daemon --offline --mount fails - #2995" '