diff --git a/src/vnet/ip/reass/ip4_sv_reass.c b/src/vnet/ip/reass/ip4_sv_reass.c
index bc7da30..b41498e 100644
--- a/src/vnet/ip/reass/ip4_sv_reass.c
+++ b/src/vnet/ip/reass/ip4_sv_reass.c
@@ -451,7 +451,7 @@
 
 	  ip4_header_t *ip0 =
 	    (ip4_header_t *) u8_ptr_add (vlib_buffer_get_current (b0),
-					 is_output_feature *
+					 (is_output_feature ? 1 : 0) *
 					 vnet_buffer (b0)->
 					 ip.save_rewrite_length);
 	  if (!ip4_get_fragment_more (ip0) && !ip4_get_fragment_offset (ip0))
@@ -597,6 +597,11 @@
 	      {
 		u32 bi0 = vec_elt (reass->cached_buffers, idx);
 		vlib_buffer_t *b0 = vlib_get_buffer (vm, bi0);
+		ip0 =
+		  (ip4_header_t *) u8_ptr_add (vlib_buffer_get_current (b0),
+					       (is_output_feature ? 1 : 0) *
+					       vnet_buffer (b0)->
+					       ip.save_rewrite_length);
 		u32 next0 = IP4_SV_REASSEMBLY_NEXT_INPUT;
 		if (is_feature)
 		  {
@@ -617,7 +622,7 @@
 		to_next += 1;
 		n_left_to_next -= 1;
 		vnet_buffer (b0)->ip.reass.is_non_first_fragment =
-		  ! !ip4_get_fragment_offset (vlib_buffer_get_current (b0));
+		  ! !ip4_get_fragment_offset (ip0);
 		vnet_buffer (b0)->ip.reass.ip_proto = reass->ip_proto;
 		vnet_buffer (b0)->ip.reass.icmp_type_or_tcp_flags =
 		  reass->icmp_type_or_tcp_flags;