diff --git a/lldp/rx.c b/lldp/rx.c
index f44b439..8f6f220 100644
--- a/lldp/rx.c
+++ b/lldp/rx.c
@@ -407,9 +407,13 @@ void rxProcessFrame(struct port *port, struct lldp_agent *agent)
 
 			err = np->ops->lldp_mod_rchange(port, agent, tlv);
 
-			if (!err)
+			if (!err) {
+				/* Module claimed the TLV; do not pass a possibly freed
+				 * pointer to later modules in the list.
+				 */
 				tlv_stored = true;
-			else if (err == TLV_ERR) {
+				break;
+			} else if (err == TLV_ERR) {
 				frame_error++;
 				free_unpkd_tlv(tlv);
 				goto out;
diff --git a/lldp_mand_cmds.c b/lldp_mand_cmds.c
index bfbe98f..e90cdf8 100644
--- a/lldp_mand_cmds.c
+++ b/lldp_mand_cmds.c
@@ -695,7 +695,8 @@ int get_tlvs(struct cmd *cmd, char *rbuf, int rlen)
 			}
 
 			if (tlvid == cmd->tlvid) {
-				memcpy(tlvs+moff, tlvs+off, sizeof(u16)+len);
+				/* overlapping src/dst when matching TLVs are compacted forward */
+				memmove(tlvs+moff, tlvs+off, sizeof(u16)+len);
 				moff += sizeof(u16)+len;
 			}