diff --git a/node/IncomingPacket.cpp b/node/IncomingPacket.cpp
index 9c13a283f..856538b45 100644
--- a/node/IncomingPacket.cpp
+++ b/node/IncomingPacket.cpp
@@ -875,6 +875,8 @@ bool IncomingPacket::_doNETWORK_CREDENTIALS(const RuntimeEnvironment *RR,const S
 				}
 			}
 
+			if (p >= size()) return true;
+
 			const unsigned int numTags = at<uint16_t>(p); p += 2;
 			for(unsigned int i=0;i<numTags;++i) {
 				p += tag.deserialize(*this,p);
@@ -893,6 +895,8 @@ bool IncomingPacket::_doNETWORK_CREDENTIALS(const RuntimeEnvironment *RR,const S
 				}
 			}
 
+			if (p >= size()) return true;
+
 			const unsigned int numRevocations = at<uint16_t>(p); p += 2;
 			for(unsigned int i=0;i<numRevocations;++i) {
 				p += revocation.deserialize(*this,p);
@@ -911,6 +915,8 @@ bool IncomingPacket::_doNETWORK_CREDENTIALS(const RuntimeEnvironment *RR,const S
 				}
 			}
 
+			if (p >= size()) return true;
+
 			const unsigned int numCoos = at<uint16_t>(p); p += 2;
 			for(unsigned int i=0;i<numCoos;++i) {
 				p += coo.deserialize(*this,p);
diff --git a/node/Node.hpp b/node/Node.hpp
index 39cf26014..ab201f061 100644
--- a/node/Node.hpp
+++ b/node/Node.hpp
@@ -227,8 +227,9 @@ public:
 	 */
 	inline void expectReplyTo(const uint64_t packetId)
 	{
-		const unsigned long bucket = (unsigned long)(packetId & ZT_EXPECTING_REPLIES_BUCKET_MASK1);
-		_expectingRepliesTo[bucket][_expectingRepliesToBucketPtr[bucket]++ & ZT_EXPECTING_REPLIES_BUCKET_MASK2] = (uint32_t)(packetId >> 32);
+		const unsigned long pid2 = (unsigned long)(packetId >> 32);
+		const unsigned long bucket = (unsigned long)(pid2 & ZT_EXPECTING_REPLIES_BUCKET_MASK1);
+		_expectingRepliesTo[bucket][_expectingRepliesToBucketPtr[bucket]++ & ZT_EXPECTING_REPLIES_BUCKET_MASK2] = (uint32_t)pid2;
 	}
 
 	/**
@@ -243,10 +244,10 @@ public:
 	 */
 	inline bool expectingReplyTo(const uint64_t packetId) const
 	{
-		const unsigned long bucket = (unsigned long)(packetId & ZT_EXPECTING_REPLIES_BUCKET_MASK1);
-		const uint32_t pid = (uint32_t)(packetId >> 32);
+		const uint32_t pid2 = (uint32_t)(packetId >> 32);
+		const unsigned long bucket = (unsigned long)(pid2 & ZT_EXPECTING_REPLIES_BUCKET_MASK1);
 		for(unsigned long i=0;i<=ZT_EXPECTING_REPLIES_BUCKET_MASK2;++i) {
-			if (_expectingRepliesTo[bucket][i] == pid)
+			if (_expectingRepliesTo[bucket][i] == pid2)
 				return true;
 		}
 		return false;