diff --git a/CHANGELOG b/CHANGELOG
index a3524429c..785416385 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -102,6 +102,14 @@ o [Zenmap] Fixed a crash when something that looked like a format
     ValueError: unsupported format character 'y' (0x79)
   [David]
 
+o A bug was fixed in route finding on BSD Unix. The libdnet function
+  addr_stob didn't handle the special case of the sa_len member of
+  struct sockaddr being equal to 0 and accessed unrelated memory past
+  the end of the sockaddr. A symptom of this was the fatal error
+    nexthost: failed to determine route to ...
+  which was caused by the default route being assigned a netmask other
+  than 0.0.0.0. [David]
+
 o Added bindings for the service control (SVCCTL) and at service (ATSVC)
   services. These are both related to running processes on the remote 
   system (identical to how PsExec-style scripts work). These bindings
diff --git a/libdnet-stripped/NMAP_MODIFICATIONS b/libdnet-stripped/NMAP_MODIFICATIONS
index a29cee93d..18d03f28e 100644
--- a/libdnet-stripped/NMAP_MODIFICATIONS
+++ b/libdnet-stripped/NMAP_MODIFICATIONS
@@ -449,3 +449,29 @@ Added eth_get_pcap_devname() that matches up a dnet name to its pcap
 equivalent by matching hardwar addresses.  It's similar to the code
 used in eth_open()
 
+o Handle the case of sa_len == 0 (meaning 0.0.0.0) in addr_stob.
+Index: src/addr.c
+===================================================================
+--- src/addr.c	(revision 12591)
++++ src/addr.c	(working copy)
+@@ -385,11 +385,17 @@
+ 	} else
+ #endif
+ 	{
++		p = (u_char *)&so->sin.sin_addr.s_addr;
+ #ifdef HAVE_SOCKADDR_SA_LEN
+-		if ((len = sa->sa_len - IP_ADDR_LEN) > IP_ADDR_LEN)
++		len = sa->sa_len - ((void *) p - (void *) sa);
++		/* Handles the special case of sa->sa_len == 0. */
++		if (len < 0)
++			len = 0;
++		else if (len > IP_ADDR_LEN)
++			len = IP_ADDR_LEN;
++#else
++		len = IP_ADDR_LEN;
+ #endif
+-		len = IP_ADDR_LEN;
+-		p = (u_char *)&so->sin.sin_addr.s_addr;
+ 	}
+ 	for (n = i = 0; i < len; i++, n += 8) {
+ 		if (p[i] != 0xff)
diff --git a/libdnet-stripped/src/addr.c b/libdnet-stripped/src/addr.c
index 08364c918..073e8e3fe 100644
--- a/libdnet-stripped/src/addr.c
+++ b/libdnet-stripped/src/addr.c
@@ -385,11 +385,17 @@ addr_stob(const struct sockaddr *sa, uint16_t *bits)
 	} else
 #endif
 	{
-#ifdef HAVE_SOCKADDR_SA_LEN
-		if ((len = sa->sa_len - IP_ADDR_LEN) > IP_ADDR_LEN)
-#endif
-		len = IP_ADDR_LEN;
 		p = (u_char *)&so->sin.sin_addr.s_addr;
+#ifdef HAVE_SOCKADDR_SA_LEN
+		len = sa->sa_len - ((void *) p - (void *) sa);
+		/* Handles the special case of sa->sa_len == 0. */
+		if (len < 0)
+			len = 0;
+		else if (len > IP_ADDR_LEN)
+			len = IP_ADDR_LEN;
+#else
+		len = IP_ADDR_LEN;
+#endif
 	}
 	for (n = i = 0; i < len; i++, n += 8) {
 		if (p[i] != 0xff)