diff --git a/src/dhcp6.c b/src/dhcp6.c
index 91341994..167b83a7 100644
--- a/src/dhcp6.c
+++ b/src/dhcp6.c
@@ -1093,7 +1093,7 @@ dhcp6_makemessage(struct interface *ifp)
 
 				/* RFC6603 Section 4.2 */
 				if (ap->prefix_exclude_len) {
-					uint8_t exb[16], *ep, u8;
+					uint8_t exb[17], *ep, u8;
 					const uint8_t *pp;
 
 					n = (size_t)((ap->prefix_exclude_len -
diff --git a/src/ipv6nd.c b/src/ipv6nd.c
index ccf71241..557ff50e 100644
--- a/src/ipv6nd.c
+++ b/src/ipv6nd.c
@@ -1789,6 +1789,7 @@ ipv6nd_expirera(void *arg)
 				logwarnx("%s: expired route %s",
 				    rap->iface->name, rinfo->sprefix);
 				TAILQ_REMOVE(&rap->rinfos, rinfo, next);
+				free(rinfo);
 			}
 		}