diff --git a/usr.sbin/ppp/mbuf.c b/usr.sbin/ppp/mbuf.c
index 2d1df62d270b..5bd58dcc6fc9 100644
--- a/usr.sbin/ppp/mbuf.c
+++ b/usr.sbin/ppp/mbuf.c
@@ -234,7 +234,8 @@ m_prepend(struct mbuf *bp, const void *ptr, size_t len, size_t extra)
   head = m_get(len + extra, bp ? bp->m_type : MB_UNKNOWN);
   head->m_offset = extra;
   head->m_len -= extra;
-  memcpy(MBUF_CTOP(head), ptr, len);
+  if (ptr)
+    memcpy(MBUF_CTOP(head), ptr, len);
   head->m_next = bp;
 
   return head;
@@ -398,3 +399,19 @@ m_settype(struct mbuf *bp, int type)
       MemMap[type].octets += bp->m_size;
     }
 }
+
+struct mbuf *
+m_append(struct mbuf *m, const void *v, size_t sz)
+{
+  if (m) {
+    while (m->m_next)
+      m = m->m_next;
+    if (m->m_size - m->m_len > sz)
+      m->m_len += sz;
+    else
+      m->m_next = m_prepend(NULL, v, sz, 0);
+  } else
+    m = m_prepend(NULL, v, sz, 0);
+
+  return m;
+}
diff --git a/usr.sbin/ppp/mbuf.h b/usr.sbin/ppp/mbuf.h
index 20921cc122d8..e89e820b43e2 100644
--- a/usr.sbin/ppp/mbuf.h
+++ b/usr.sbin/ppp/mbuf.h
@@ -98,6 +98,7 @@ extern struct mbuf *m_prepend(struct mbuf *, const void *, size_t, size_t);
 extern struct mbuf *m_adj(struct mbuf *, ssize_t);
 extern struct mbuf *m_pullup(struct mbuf *);
 extern void m_settype(struct mbuf *, int);
+extern struct mbuf *m_append(struct mbuf *, const void *, size_t);
 
 extern int mbuf_Show(struct cmdargs const *);
 
diff --git a/usr.sbin/ppp/nat_cmd.c b/usr.sbin/ppp/nat_cmd.c
index bc789292650a..a2fb917b5614 100644
--- a/usr.sbin/ppp/nat_cmd.c
+++ b/usr.sbin/ppp/nat_cmd.c
@@ -52,6 +52,8 @@
 #include "bundle.h"
 
 
+#define NAT_EXTRABUF (13)
+
 static int StrToAddr(const char *, struct in_addr *);
 static int StrToPortRange(const char *, u_short *, u_short *, const char *);
 static int StrToAddrAndPort(const char *, struct in_addr *, u_short *,
@@ -344,8 +346,10 @@ nat_LayerPush(struct bundle *bundle, struct link *l, struct mbuf *bp,
 
   log_Printf(LogDEBUG, "nat_LayerPush: PROTO_IP -> PROTO_IP\n");
   m_settype(bp, MB_NATOUT);
-  bp = m_pullup(bp);
+  /* Ensure there's a bit of extra buffer for the NAT code... */
+  bp = m_pullup(m_append(bp, NULL, NAT_EXTRABUF));
   PacketAliasOut(MBUF_CTOP(bp), bp->m_len);
+  bp->m_len = ntohs(((struct ip *)MBUF_CTOP(bp))->ip_len);
 
   return bp;
 }
@@ -372,6 +376,8 @@ nat_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp,
       (pip->ip_p == IPPROTO_IPIP && IN_CLASSD(ntohl(piip->ip_dst.s_addr))))
     return bp;
 
+  /* Ensure there's a bit of extra buffer for the NAT code... */
+  bp = m_pullup(m_append(bp, NULL, NAT_EXTRABUF));
   ret = PacketAliasIn(MBUF_CTOP(bp), bp->m_len);
 
   bp->m_len = ntohs(pip->ip_len);