diff --git a/openair3/NAS/NR_UE/5GS/5GSM/MSG/PduSessionEstablishmentAccept.c b/openair3/NAS/NR_UE/5GS/5GSM/MSG/PduSessionEstablishmentAccept.c
index 50b66845c6..cb12e5dc6c 100644
--- a/openair3/NAS/NR_UE/5GS/5GSM/MSG/PduSessionEstablishmentAccept.c
+++ b/openair3/NAS/NR_UE/5GS/5GSM/MSG/PduSessionEstablishmentAccept.c
@@ -94,7 +94,7 @@ int decode_pdu_session_establishment_accept_msg(pdu_session_establishment_accept
   {
     qos_rules->rule[0] = decode_qos_rule(curPtr);
     rules_tot_len += get_len_qos_rule(&qos_rules->rule[0]);
-    curPtr += rules_tot_len;
+    curPtr += get_len_qos_rule(&qos_rules->rule[0]);
   }
   // Session-AMBR (M)
   psea_msg->sess_ambr.length = *curPtr++;
diff --git a/openair3/NAS/NR_UE/nr_nas_msg.c b/openair3/NAS/NR_UE/nr_nas_msg.c
index 64a541aa78..d1e1a4d448 100644
--- a/openair3/NAS/NR_UE/nr_nas_msg.c
+++ b/openair3/NAS/NR_UE/nr_nas_msg.c
@@ -1050,7 +1050,7 @@ static void process_pdu_session_addr(pdu_session_establishment_accept_msg_t *msg
 {
   uint8_t *addr = msg->pdu_addr_ie.pdu_addr_oct;
 
-  switch (msg->pdu_addr_ie.pdu_type) {
+  switch (msg->pdu_type) {
     case PDU_SESSION_TYPE_IPV4: {
       char ip[20];
       capture_ipv4_addr(&addr[0], ip, sizeof(ip));