--- src/rx/rx.c	2001/09/07 20:47:57	1.22
+++ src/rx/rx.c	2001/09/19 22:50:19
@@ -2363,7 +2363,7 @@
 #endif
 
     if(np->header.type == RX_PACKET_TYPE_VERSION) {
-      return rxi_ReceiveVersionPacket(np,socket,host,port, 1);
+	return rxi_ReceiveVersionPacket(np,socket,host,port, 1);
     }
 
     if (np->header.type == RX_PACKET_TYPE_DEBUG) {
@@ -3460,7 +3460,7 @@
 
     /* if the ack packet has a receivelen field hanging off it,
      * update our state */
-    if ( np->length >= rx_AckDataSize(ap->nAcks) +sizeof(afs_int32)) {
+    if ( np->length >= rx_AckDataSize(ap->nAcks) + 2*sizeof(afs_int32)) {
       afs_uint32 tSize;
 
       /* If the ack packet has a "recommended" size that is less than 

--- src/rx/rx_packet.c	2001/09/07 20:47:57	1.14
+++ src/rx/rx_packet.c	2001/09/19 22:50:19
@@ -272,7 +272,7 @@
   queue_Remove(c);
   if (!(c->flags & RX_PKTFLAG_FREE))
     osi_Panic("rxi_AllocPacket: packet not free\n");
-  c->flags &= ~RX_PKTFLAG_FREE;
+  c->flags = 0;		/* clear RX_PKTFLAG_FREE, initialize the rest */
   c->header.flags = 0;
   
 #ifdef KERNEL
@@ -631,7 +631,7 @@
   dpf(("Alloc %x, class %d\n", p, class));
   
   queue_Remove(p);
-  p->flags &= ~RX_PKTFLAG_FREE;
+  p->flags = 0;		/* clear RX_PKTFLAG_FREE, initialize the rest */
   p->header.flags = 0;
   
   /* have to do this here because rx_FlushWrite fiddles with the iovs in
@@ -788,8 +788,8 @@
     * our problems caused by the lack of a length field in the rx header.
     * Use the extra buffer that follows the localdata in each packet
     * structure. */
-    savelen = p->wirevec[p->niovecs].iov_len;
-    p->wirevec[p->niovecs].iov_len += RX_EXTRABUFFERSIZE;
+    savelen = p->wirevec[p->niovecs-1].iov_len;
+    p->wirevec[p->niovecs-1].iov_len += RX_EXTRABUFFERSIZE;
 
     memset((char *)&msg, 0, sizeof(msg));
     msg.msg_name = (char *) &from;
@@ -799,7 +799,7 @@
     nbytes = rxi_Recvmsg(socket, &msg, 0);
 
    /* restore the vec to its correct state */
-    p->wirevec[p->niovecs].iov_len = savelen;
+    p->wirevec[p->niovecs-1].iov_len = savelen;
 
     p->length = (nbytes - RX_HEADER_SIZE);
     if ((nbytes > tlen) || (p->length  & 0x8000)) {  /* Bogus packet */
@@ -1379,7 +1379,7 @@
 	default:
 	    /* error response packet */
 	    tin.type = htonl(RX_DEBUGI_BADTYPE);
-	    tin.index = tin.type;
+	    tin.index = htonl(tin.type);
 	    rx_packetwrite(ap, 0, sizeof(struct rx_debugIn), (char *)&tin);
 	    tl = ap->length;
 	    ap->length = sizeof(struct rx_debugIn);