diff --git a/lib/libnetmap/nmreq.c b/lib/libnetmap/nmreq.c
index 259056de37b4..7f4b2703d22d 100644
--- a/lib/libnetmap/nmreq.c
+++ b/lib/libnetmap/nmreq.c
@@ -603,10 +603,9 @@ nmreq_options_decode(const char *opt, struct nmreq_opt_parser parsers[],
 struct nmreq_option *
 nmreq_find_option(struct nmreq_header *h, uint32_t t)
 {
-	struct nmreq_option *o;
+	struct nmreq_option *o = NULL;
 
-	for (o = (struct nmreq_option *)h->nr_options; o != NULL;
-			o = (struct nmreq_option *)o->nro_next) {
+	nmreq_foreach_option(h, o) {
 		if (o->nro_reqtype == t)
 			break;
 	}
@@ -633,8 +632,14 @@ nmreq_free_options(struct nmreq_header *h)
 {
 	struct nmreq_option *o, *next;
 
-	for (o = (struct nmreq_option *)h->nr_options; o != NULL; o = next) {
-		next = (struct nmreq_option *)o->nro_next;
+	/*
+	 * Note: can't use nmreq_foreach_option() here; it frees the
+	 * list as it's walking and nmreq_foreach_option() isn't
+	 * modification-safe.
+	 */
+	for (o = (struct nmreq_option *)(uintptr_t)h->nr_options; o != NULL;
+	    o = next) {
+		next = (struct nmreq_option *)(uintptr_t)o->nro_next;
 		free(o);
 	}
 }