diff --git a/sbin/ipf/common/lexer.c b/sbin/ipf/common/lexer.c
--- a/sbin/ipf/common/lexer.c
+++ b/sbin/ipf/common/lexer.c
@@ -449,7 +449,7 @@
 		oc = c;
 
 		if (prior == YY_NUMBER && c == ':') {
-			snprintf(s, sizeof(s), "%d", priornum);
+			snprintf(s, sizeof(ipv6buf), "%d", priornum);
 			s += strlen(s);
 		}