diff --git a/TODO b/TODO
index 7eb9bed7..22e7efe0 100644
--- a/TODO
+++ b/TODO
@@ -22,6 +22,8 @@ Core
 - client: paging?
 - client: data losses on large dumps?
 
+- table: ocassional core dumps in rt_prune()
+
 - bgp: timing of updates?
 - bgp: dump and get_route_info
 
diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c
index 7a866fca..0d9b702a 100644
--- a/proto/bgp/packets.c
+++ b/proto/bgp/packets.c
@@ -62,7 +62,7 @@ bgp_encode_prefixes(struct bgp_proto *p, byte *w, struct bgp_bucket *buck, unsig
       ipa_hton(a);
       memcpy(w, &a, bytes);
       w += bytes;
-      remains -= bytes;
+      remains -= bytes + 1;
       rem_node(&px->bucket_node);
       fib_delete(&p->prefix_fib, px);
     }
@@ -232,11 +232,17 @@ bgp_fire_tx(struct bgp_conn *conn)
   struct bgp_proto *p = conn->bgp;
   unsigned int s = conn->packets_to_send;
   sock *sk = conn->sk;
-  byte *buf = sk->tbuf;
-  byte *pkt = buf + BGP_HEADER_LENGTH;
-  byte *end;
+  byte *buf, *pkt, *end;
   int type;
 
+  if (!sk)
+    {
+      conn->packets_to_send = 0;
+      return 0;
+    }
+  buf = sk->tbuf;
+  pkt = buf + BGP_HEADER_LENGTH;
+
   if (s & (1 << PKT_SCHEDULE_CLOSE))
     {
       bgp_close_conn(conn);
@@ -284,7 +290,7 @@ bgp_schedule_packet(struct bgp_conn *conn, int type)
 {
   DBG("BGP: Scheduling packet type %d\n", type);
   conn->packets_to_send |= 1 << type;
-  if (conn->sk->tpos == conn->sk->tbuf)
+  if (conn->sk && conn->sk->tpos == conn->sk->tbuf)
     while (bgp_fire_tx(conn))
       ;
 }