Index: uspace/srv/net/udp/service.c
===================================================================
--- uspace/srv/net/udp/service.c	(revision cecba66ea48d60cfa59865e98aeda663808e42c7)
+++ uspace/srv/net/udp/service.c	(revision 82d515e917f3eeeff253e4aa30e493f5f632c950)
@@ -570,5 +570,5 @@
 
 	rc = async_data_read_finalize(callid, &enext->epp.remote,
-	    max(size, (ssize_t)sizeof(inet_ep_t)));
+	    max(size, (size_t)sizeof(inet_ep_t)));
 	if (rc != EOK) {
 		async_answer_0(iid, rc);
@@ -596,9 +596,9 @@
 {
 	ipc_callid_t callid;
-	ssize_t msg_size;
+	size_t msg_size;
 	udp_crcv_queue_entry_t *enext;
 	void *data;
 	size_t size;
-	ssize_t off;
+	size_t off;
 	int rc;
 
@@ -623,6 +623,11 @@
 	msg_size = enext->msg->data_size;
 
-	rc = async_data_read_finalize(callid, data, max(msg_size - off,
-	    (ssize_t)size));
+	if (off > msg_size) {
+		async_answer_0(callid, EINVAL);
+		async_answer_0(iid, EINVAL);
+		return;
+	}
+
+	rc = async_data_read_finalize(callid, data, min(msg_size - off, size));
 	if (rc != EOK) {
 		async_answer_0(iid, rc);