Index: head/lib/libnetmap/nmreq.c
===================================================================
--- head/lib/libnetmap/nmreq.c
+++ head/lib/libnetmap/nmreq.c
@@ -603,10 +603,9 @@
 struct nmreq_option *
 nmreq_find_option(struct nmreq_header *h, uint32_t t)
 {
-	struct nmreq_option *o;
+	struct nmreq_option *o = NULL;
 
-	for (o = (struct nmreq_option *)h->nr_options; o != NULL;
-			o = (struct nmreq_option *)o->nro_next) {
+	nmreq_foreach_option(h, o) {
 		if (o->nro_reqtype == t)
 			break;
 	}
@@ -633,8 +632,14 @@
 {
 	struct nmreq_option *o, *next;
 
-	for (o = (struct nmreq_option *)h->nr_options; o != NULL; o = next) {
-		next = (struct nmreq_option *)o->nro_next;
+	/*
+	 * Note: can't use nmreq_foreach_option() here; it frees the
+	 * list as it's walking and nmreq_foreach_option() isn't
+	 * modification-safe.
+	 */
+	for (o = (struct nmreq_option *)(uintptr_t)h->nr_options; o != NULL;
+	    o = next) {
+		next = (struct nmreq_option *)(uintptr_t)o->nro_next;
 		free(o);
 	}
 }