diff --git a/src/core/ipv6/icmp6.c b/src/core/ipv6/icmp6.c
index 57e41595..d0d0812b 100644
--- a/src/core/ipv6/icmp6.c
+++ b/src/core/ipv6/icmp6.c
@@ -389,8 +389,11 @@ icmp6_send_response_with_addrs_and_netif(struct pbuf *p, u8_t code, u32_t data,
 {
   struct pbuf *q;
   struct icmp6_hdr *icmp6hdr;
-  u16_t datalen = LWIP_MIN(p->tot_len, LWIP_ICMP6_DATASIZE);
+  u16_t datalen;
 
+  LWIP_ASSERT("pbuf is NULL", p != NULL);
+
+  datalen = LWIP_MIN(p->tot_len, LWIP_ICMP6_DATASIZE);
   /* ICMPv6 header + datalen (as much of the offending packet as possible) */
   q = pbuf_alloc(PBUF_IP, sizeof(struct icmp6_hdr) + datalen,
                  PBUF_RAM);
diff --git a/src/core/udp.c b/src/core/udp.c
index b78e94f6..1a285bd5 100644
--- a/src/core/udp.c
+++ b/src/core/udp.c
@@ -545,6 +545,7 @@ udp_sendto_chksum(struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *dst_ip,
   if (IP_IS_V4MAPPEDV6(dst_ip)) {
     ip_addr_t dest_ipv4;
     unmap_ipv4_mapped_ipv6(ip_2_ip4(&dest_ipv4), ip_2_ip6(dst_ip));
+    IP_SET_TYPE_VAL(dest_ipv4, IPADDR_TYPE_V4);
 #if LWIP_CHECKSUM_ON_COPY
     return udp_sendto_chksum(pcb, p, &dest_ipv4, dst_port, have_chksum, chksum);
 #else