Index: uspace/srv/net/inetsrv/pdu.c
===================================================================
--- uspace/srv/net/inetsrv/pdu.c	(revision 5c2e8d0339bfbdecae398beea9df133efef62a9f)
+++ uspace/srv/net/inetsrv/pdu.c	(revision ebc9c2cfd20bdd5c2f62803f849f0b88de5212c0)
@@ -106,8 +106,8 @@
 {
 	/* Upper bound for fragment offset field */
-	size_t fragoff_limit = 1 << (FF_FRAGOFF_h - FF_FRAGOFF_l);
+	size_t fragoff_limit = 1 << (FF_FRAGOFF_h - FF_FRAGOFF_l + 1);
 	
 	/* Verify that total size of datagram is within reasonable bounds */
-	if (offs + packet->size > FRAG_OFFS_UNIT * fragoff_limit)
+	if (packet->size > FRAG_OFFS_UNIT * fragoff_limit)
 		return ELIMIT;
 	
Index: uspace/srv/net/inetsrv/reass.c
===================================================================
--- uspace/srv/net/inetsrv/reass.c	(revision 5c2e8d0339bfbdecae398beea9df133efef62a9f)
+++ uspace/srv/net/inetsrv/reass.c	(revision ebc9c2cfd20bdd5c2f62803f849f0b88de5212c0)
@@ -196,4 +196,6 @@
 		return ENOMEM;
 
+	memcpy(data_copy, packet->data, packet->size);
+
 	frag->packet = *packet;
 	frag->packet.data = data_copy;
@@ -216,5 +218,5 @@
 			break;
 
-		link = link->next;
+		link = list_next(link, &rdg->frags);
 	}
 
@@ -240,15 +242,20 @@
 	assert(!list_empty(&rdg->frags));
 
+	link = list_first(&rdg->frags);
+	assert(link != NULL);
+
+	frag = list_get_instance(link, reass_frag_t,
+	    dgram_link);
+
 	/* First fragment must be at offset zero */
-	frag = list_get_instance(list_first(&rdg->frags), reass_frag_t,
-	    dgram_link);
 	if (frag->packet.offs != 0)
 		return false;
 
 	prev = frag;
+
 	while (true) {
-		link = frag->dgram_link.next;
+		link = list_next(link, &rdg->frags);
 		if (link == NULL)
-			return false;
+			break;
 
 		/* Each next fragment must follow immediately or overlap */
@@ -288,4 +295,5 @@
 	uint8_t proto;
 	reass_frag_t *frag;
+	int rc;
 
 	/*
@@ -307,5 +315,5 @@
 
 	/* Upper bound for fragment offset field */
-	fragoff_limit = 1 << (FF_FRAGOFF_h - FF_FRAGOFF_l);
+	fragoff_limit = 1 << (FF_FRAGOFF_h - FF_FRAGOFF_l + 1);
 
 	/* Verify that total size of datagram is within reasonable bounds */
@@ -343,5 +351,7 @@
 	}
 
-	return inet_recv_dgram_local(&dgram, proto);
+	rc = inet_recv_dgram_local(&dgram, proto);
+	free(dgram.data);
+	return rc;
 }