diff --git a/lib/libc/net/getaddrinfo.c b/lib/libc/net/getaddrinfo.c
index 8b6d6b725190..a1f2726a1f86 100644
--- a/lib/libc/net/getaddrinfo.c
+++ b/lib/libc/net/getaddrinfo.c
@@ -709,7 +709,7 @@ explore_numeric_scope(pai, hostname, servname, res)
 	switch (pai->ai_family) {
 #ifdef INET6
 	case AF_INET6:
-		scope = if_nametoindex(hostname2);
+		scope = if_nametoindex(cp);
 		if (scope == 0) {
 			error = EAI_SYSTEM;
 			goto free;
@@ -718,7 +718,7 @@ explore_numeric_scope(pai, hostname, servname, res)
 #endif
 	}
 
-	error = explore_numeric(pai, cp, servname, res);
+	error = explore_numeric(pai, hostname2, servname, res);
 	if (error == 0) {
 		for (cur = *res; cur; cur = cur->ai_next) {
 #ifdef INET6
diff --git a/lib/libc/net/getnameinfo.c b/lib/libc/net/getnameinfo.c
index 42f7906ee9f9..5edcffb9498c 100644
--- a/lib/libc/net/getnameinfo.c
+++ b/lib/libc/net/getnameinfo.c
@@ -199,14 +199,11 @@ getnameinfo(sa, salen, host, hostlen, serv, servlen, flags)
 				    + scopelen > hostlen)
 					return ENI_MEMORY;
 				/*
-				 * Shift the host string to allocate
-				 * space for the scope ID part.
+				 * Construct <numeric-addr><delim><scopeid>
 				 */
-				memmove(host + scopelen + 1, host, numaddrlen);
-				/* copy the scope ID and the delimiter */
-				memcpy(host, ifname, scopelen);
-				host[scopelen] = SCOPE_DELIMITER;
-				host[scopelen + 1 + numaddrlen] = '\0';
+				memcpy(host + numaddrlen + 1, ifname, scopelen);
+				host[numaddrlen] = SCOPE_DELIMITER;
+				host[numaddrlen + 1 + scopelen] = '\0';
 			}
 		}
 #endif /* INET6 */
diff --git a/lib/libipsec/policy_token.l b/lib/libipsec/policy_token.l
index 1e7b7140676d..c9737cb83435 100644
--- a/lib/libipsec/policy_token.l
+++ b/lib/libipsec/policy_token.l
@@ -79,7 +79,7 @@ decstring	{digit}+
 hexpair		{hexdigit}{hexdigit}
 hexstring	0[xX]{hexdigit}+
 octetstring	{octet}({dot}{octet})+
-ipaddress	[a-zA-Z0-9:\._][a-zA-Z0-9:\._]*(@{letter}{letter}+)?
+ipaddress	[a-zA-Z0-9:\._][a-zA-Z0-9:\._]*(%{letter}{letter}+)?
 name		{letter}(({letter}|{digit}|{hyphen})*({letter}|{digit}))*
 hostname	{name}(({dot}{name})+{dot}?)?
 
diff --git a/sbin/setkey/token.l b/sbin/setkey/token.l
index b75fd45e3e7d..0154beef4388 100644
--- a/sbin/setkey/token.l
+++ b/sbin/setkey/token.l
@@ -108,7 +108,7 @@ hexstring	0[xX]{hexdigit}+
 octetstring	{octet}({dot}{octet})+
 ipaddress	{ipv4addr}|{ipv6addr}
 ipv4addr	{digit}{1,3}({dot}{digit}{1,3}){0,3}
-ipv6addr	{hexdigit}{0,4}({colon}{hexdigit}{0,4}){2,7}(@{letter}{letter}+)?
+ipv6addr	{hexdigit}{0,4}({colon}{hexdigit}{0,4}){2,7}(%{letter}{letter}+)?
 ipaddrmask	{slash}{digit}{1,3}
 ipaddrport	{blcl}{decstring}{elcl}
 keyword		{letter}{letter}+
diff --git a/usr.sbin/setkey/token.l b/usr.sbin/setkey/token.l
index b75fd45e3e7d..0154beef4388 100644
--- a/usr.sbin/setkey/token.l
+++ b/usr.sbin/setkey/token.l
@@ -108,7 +108,7 @@ hexstring	0[xX]{hexdigit}+
 octetstring	{octet}({dot}{octet})+
 ipaddress	{ipv4addr}|{ipv6addr}
 ipv4addr	{digit}{1,3}({dot}{digit}{1,3}){0,3}
-ipv6addr	{hexdigit}{0,4}({colon}{hexdigit}{0,4}){2,7}(@{letter}{letter}+)?
+ipv6addr	{hexdigit}{0,4}({colon}{hexdigit}{0,4}){2,7}(%{letter}{letter}+)?
 ipaddrmask	{slash}{digit}{1,3}
 ipaddrport	{blcl}{decstring}{elcl}
 keyword		{letter}{letter}+