diff --git a/src/device/hwm_lm75.c b/src/device/hwm_lm75.c
index c7a057ff4..ec5dd500c 100644
--- a/src/device/hwm_lm75.c
+++ b/src/device/hwm_lm75.c
@@ -64,7 +64,7 @@ lm75_remap(lm75_t *dev, uint8_t addr)
 {
     lm75_log("LM75: remapping to SMBus %02Xh\n", addr);
 
-    smbus_removehandler(dev->smbus_addr, 1,
+    if (dev->smbus_addr < 0x80) smbus_removehandler(dev->smbus_addr, 1,
     			lm75_smbus_read_byte, lm75_smbus_read_byte_cmd, lm75_smbus_read_word_cmd, NULL,
     			lm75_smbus_write_byte, lm75_smbus_write_byte_cmd, lm75_smbus_write_word_cmd, NULL,
     			dev);
diff --git a/src/device/smbus.c b/src/device/smbus.c
index d86b167c1..dfd89a95e 100644
--- a/src/device/smbus.c
+++ b/src/device/smbus.c
@@ -115,6 +115,9 @@ smbus_sethandler(uint8_t base, int size,
     int c;
     smbus_t *p, *q = NULL;
 
+    if ((base + size) >= NADDRS)
+    	return;
+
     for (c = 0; c < size; c++) {
     	p = smbus_last[base + c];
     	q = (smbus_t *) malloc(sizeof(smbus_t));
@@ -158,13 +161,17 @@ smbus_removehandler(uint8_t base, int size,
     		    void *priv)
 {
     int c;
-    smbus_t *p;
+    smbus_t *p, *q;
+
+    if ((base + size) >= NADDRS)
+    	return;
 
     for (c = 0; c < size; c++) {
     	p = smbus[base + c];
     	if (!p)
     		continue;
     	while(p) {
+    		q = p->next;
     		if ((p->read_byte == read_byte) && (p->read_byte_cmd == read_byte_cmd) &&
     		    (p->read_word_cmd == read_word_cmd) && (p->read_block_cmd == read_block_cmd) &&
     		    (p->write_byte == write_byte) && (p->write_byte_cmd == write_byte_cmd) &&
@@ -182,7 +189,7 @@ smbus_removehandler(uint8_t base, int size,
     			p = NULL;
     			break;
     		}
-    		p = p->next;
+    		p = q;
     	}
     }
 }