diff --git a/sys/src/cmd/ip/ipconfig/main.c b/sys/src/cmd/ip/ipconfig/main.c
index 3a8889d79..95941955c 100644
--- a/sys/src/cmd/ip/ipconfig/main.c
+++ b/sys/src/cmd/ip/ipconfig/main.c
@@ -1019,12 +1019,13 @@ ndb2conf(Ndb *db, uchar *myip)
 		}
 		if(strcmp(nt->attr, "ipmask") == 0) {
 			nt = uniquent(nt);
-			parseipmask(conf.mask, nt->val, isv4(myip));
+			if(parseipmask(conf.mask, nt->val, isv4(myip)) == -1)
+				goto Badip;
 			continue;
 		}
 		if(parseip(ip, nt->val) == -1) {
-			fprint(2, "%s: bad %s address in ndb: %s\n", argv0,
-				nt->attr, nt->val);
+		Badip:
+			fprint(2, "%s: bad %s address in ndb: %s\n", argv0, nt->attr, nt->val);
 			continue;
 		}
 		if(strcmp(nt->attr, "ipgw") == 0) {
diff --git a/sys/src/cmd/ndb/dblookup.c b/sys/src/cmd/ndb/dblookup.c
index 85a1e017c..ecfa7bd1d 100644
--- a/sys/src/cmd/ndb/dblookup.c
+++ b/sys/src/cmd/ndb/dblookup.c
@@ -1062,11 +1062,10 @@ createv4ptrs(void)
 			if(t == nil)	/* could be a reverse with no forward */
 				continue;
 			nt = look(t, t, "ipmask");
-			if(nt == nil){		/* we're confused */
+			if(nt == nil || parseipmask(mask, nt->val, 1) == -1){
 				ndbfree(t);
 				continue;
 			}
-			parseipmask(mask, nt->val, 1);
 			ndbfree(t);
 			n = 5;
 			break;
diff --git a/sys/src/libndb/ndbipinfo.c b/sys/src/libndb/ndbipinfo.c
index e2bb8ca6f..5ee706e55 100644
--- a/sys/src/libndb/ndbipinfo.c
+++ b/sys/src/libndb/ndbipinfo.c
@@ -123,7 +123,6 @@ subnet(Ndb *db, uchar *net, Ndbtuple *f, int prefix)
 	char netstr[64];
 	uchar mask[IPaddrlen];
 	Ndbtuple *t, *nt, *xt;
-	int masklen;
 
 	t = nil;
 	snprint(netstr, sizeof(netstr), "%I", net);
@@ -132,12 +131,9 @@ subnet(Ndb *db, uchar *net, Ndbtuple *f, int prefix)
 		xt = ndbfindattr(nt, nt, "ipnet");
 		if(xt != nil){
 			xt = ndbfindattr(nt, nt, "ipmask");
-			if(xt != nil)
-				parseipmask(mask, xt->val, isv4(net));
-			else
+			if(xt == nil || parseipmask(mask, xt->val, isv4(net)) == -1)
 				ipmove(mask, defmask(net));
-			masklen = prefixlen(mask);
-			if(masklen <= prefix){
+			if(prefixlen(mask) <= prefix){
 				t = ndbconcatenate(t, filter(db, nt, f));
 				nt = nil;
 			}