diff --git a/net/ipforward/ipfwd_dropstats.c b/net/ipforward/ipfwd_dropstats.c
index 5e818c0dfb2..94a60b8bab9 100644
--- a/net/ipforward/ipfwd_dropstats.c
+++ b/net/ipforward/ipfwd_dropstats.c
@@ -167,7 +167,8 @@ void ipfwd_dropstats(FAR struct forward_s *fwd)
   if (fwd->f_domain == PF_INET)
 #endif
     {
-      ipv4_dropstats((FAR struct ipv4_hdr_s *)fwd->f_iob->io_data);
+      ipv4_dropstats((FAR struct ipv4_hdr_s *)
+                     &fwd->f_iob->io_data[CONFIG_NET_LL_GUARDSIZE]);
     }
 #endif
 #ifdef CONFIG_NET_IPv6
@@ -175,7 +176,8 @@ void ipfwd_dropstats(FAR struct forward_s *fwd)
   else
 #endif
     {
-      ipv6_dropstats((FAR struct ipv6_hdr_s *)fwd->f_iob->io_data);
+      ipv6_dropstats((FAR struct ipv6_hdr_s *)
+                     &fwd->f_iob->io_data[CONFIG_NET_LL_GUARDSIZE]);
     }
 #endif
 }
diff --git a/net/ipforward/ipv6_forward.c b/net/ipforward/ipv6_forward.c
index 6e6fdb0244a..95ae9fd08c6 100644
--- a/net/ipforward/ipv6_forward.c
+++ b/net/ipforward/ipv6_forward.c
@@ -408,7 +408,7 @@ static int ipv6_dev_forward(FAR struct net_driver_s *dev,
        * TTL decrements to zero, then do not forward the packet.
        */
 
-      ret = ipv6_decr_ttl((FAR struct ipv6_hdr_s *)fwd->f_iob->io_data);
+      ret = ipv6_decr_ttl(ipv6);
       if (ret < 1)
         {
           nwarn("WARNING: Hop limit exceeded... Dropping!\n");