diff --git a/mbus/mbus-protocol-aux.c b/mbus/mbus-protocol-aux.c
index 0987709..60cdef4 100755
--- a/mbus/mbus-protocol-aux.c
+++ b/mbus/mbus-protocol-aux.c
@@ -2113,11 +2113,19 @@ mbus_probe_secondary_address(mbus_handle *handle, const char *mask, char *matchi
         }
 
         if (ret == MBUS_RECV_RESULT_INVALID)
+        {
+            /* check for more data (collision) */
+            mbus_purge_frames(handle);
+            return MBUS_PROBE_COLLISION;
+        }
+        
+        /* check for more data (collision) */
+        if (mbus_purge_frames(handle))
         {
             return MBUS_PROBE_COLLISION;
         }
 
-        if (mbus_frame_type(&reply) != MBUS_FRAME_TYPE_ACK)
+        if (mbus_frame_type(&reply) == MBUS_FRAME_TYPE_LONG)
         {
             char *addr = mbus_frame_get_secondary_address(&reply);
 
@@ -2125,6 +2133,7 @@ mbus_probe_secondary_address(mbus_handle *handle, const char *mask, char *matchi
             {
                 // show error message, but procede with scan
                 MBUS_ERROR("Failed to generate secondary address from M-Bus reply frame: %s\n", mbus_error_str());
+                return MBUS_PROBE_NOTHING;
             }
             
             snprintf(matching_addr, 17, "%s", addr);
@@ -2138,7 +2147,7 @@ mbus_probe_secondary_address(mbus_handle *handle, const char *mask, char *matchi
         }
         else
         {
-            MBUS_ERROR("%s: Unexpected reply for address [mask %s]. Got ACK, expected data.\n",
+            MBUS_ERROR("%s: Unexpected reply for address [mask %s]. Expected long frame.\n",
                        __PRETTY_FUNCTION__, mask);
             return MBUS_PROBE_NOTHING;
         }
diff --git a/mbus/mbus-protocol.c b/mbus/mbus-protocol.c
index b9243c6..39d8c03 100755
--- a/mbus/mbus-protocol.c
+++ b/mbus/mbus-protocol.c
@@ -2181,16 +2181,16 @@ mbus_data_record_decode(mbus_data_record *record)
     static char buff[768];
     unsigned char vif, vife;
     
-    // ignore extension bit
-    vif = (record->drh.vib.vif & MBUS_DIB_VIF_WITHOUT_EXTENSION);       
-    vife = (record->drh.vib.vife[0] & MBUS_DIB_VIF_WITHOUT_EXTENSION);
-
     if (record)
     {
         int val;
         float val3;
         long long val4;
         struct tm time;
+        
+        // ignore extension bit
+        vif = (record->drh.vib.vif & MBUS_DIB_VIF_WITHOUT_EXTENSION);       
+        vife = (record->drh.vib.vife[0] & MBUS_DIB_VIF_WITHOUT_EXTENSION);
             
         switch (record->drh.dib.dif & 0x0F)
         {
@@ -2835,7 +2835,7 @@ mbus_data_variable_parse(mbus_frame *frame, mbus_data_variable *data)
                 {
                     unsigned char vife;
                     
-                    if (record->drh.vib.nvife > NITEMS(record->drh.vib.vife))
+                    if (record->drh.vib.nvife >= NITEMS(record->drh.vib.vife))
                     {
                         mbus_data_record_free(record);
                         snprintf(error_str, sizeof(error_str), "Too many VIFE.");
@@ -4047,11 +4047,13 @@ mbus_frame_get_secondary_address(mbus_frame *frame)
     if (frame->control_information != MBUS_CONTROL_INFO_RESP_VARIABLE)
     {
         snprintf(error_str, sizeof(error_str), "Non-variable data response (can't get secondary address from response).");
+        mbus_frame_data_free(data);
         return NULL;
     }
 
     if (mbus_frame_data_parse(frame, data) == -1)
     {
+        mbus_frame_data_free(data);
         return NULL;
     }