diff --git a/src/apps/altcp_tls/altcp_tls_mbedtls.c b/src/apps/altcp_tls/altcp_tls_mbedtls.c
index 60b155cc..853ed7ce 100644
--- a/src/apps/altcp_tls/altcp_tls_mbedtls.c
+++ b/src/apps/altcp_tls/altcp_tls_mbedtls.c
@@ -467,7 +467,7 @@ altcp_mbedtls_bio_recv(void *ctx, unsigned char *buf, size_t len)
   ret = pbuf_copy_partial(p, buf, copy_len, 0);
   LWIP_ASSERT("ret == copy_len", ret == copy_len);
   /* hide the copied bytes from the pbuf */
-  err = pbuf_header(p, -(s16_t)ret);
+  err = pbuf_remove_header(p, ret);
   LWIP_ASSERT("error", err == ERR_OK);
   if (p->len == 0) {
     /* the first pbuf has been fully read, free it */
diff --git a/src/core/ipv6/dhcp6.c b/src/core/ipv6/dhcp6.c
index f27a725e..ecad68b1 100644
--- a/src/core/ipv6/dhcp6.c
+++ b/src/core/ipv6/dhcp6.c
@@ -1,11 +1,10 @@
 /**
  * @file
- *
- * DHCPv6.
+ * DHCPv6 - RFC 3315
  */
 
 /*
- * Copyright (c) 2010 Inico Technologies Ltd.
+ * Copyright (c) 2017 Simon Goldschmidt
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without modification,
@@ -32,19 +31,255 @@
  *
  * This file is part of the lwIP TCP/IP stack.
  *
- * Author: Ivan Delamer <delamer@inicotech.com>
- *
- *
- * Please coordinate changes and requests with Ivan Delamer
- * <delamer@inicotech.com>
+ * Author: Simon Goldschmidt <goldsimon@gmx.de>
  */
 
 #include "lwip/opt.h"
 
 #if LWIP_IPV6 && LWIP_IPV6_DHCP6 /* don't build if not configured for use in lwipopts.h */
 
-#include "lwip/ip6_addr.h"
+#include "lwip/dhcp6.h"
+#include "lwip/prot/dhcp6.h"
 #include "lwip/def.h"
+#include "lwip/udp.h"
 
+#include <string.h>
+
+#ifdef LWIP_HOOK_FILENAME
+#include LWIP_HOOK_FILENAME
+#endif
+#ifndef LWIP_HOOK_DHCP6_APPEND_OPTIONS
+#define LWIP_HOOK_DHCP6_APPEND_OPTIONS(netif, dhcp6, state, msg, msg_type)
+#endif
+#ifndef LWIP_HOOK_DHCP6_PARSE_OPTION
+#define LWIP_HOOK_DHCP6_PARSE_OPTION(netif, dhcp6, state, msg, msg_type, option, len, pbuf, offset)
+#endif
+
+const ip_addr_t dhcp6_All_DHCP_Relay_Agents_and_Servers = IPADDR6_INIT_HOST(0xFF020000, 0, 0, 0x00010002);
+const ip_addr_t dhcp6_All_DHCP_Servers = IPADDR6_INIT_HOST(0xFF020000, 0, 0, 0x00010003);
+
+static struct udp_pcb *dhcp6_pcb;
+static u8_t dhcp6_pcb_refcount;
+
+
+/* receive, unfold, parse and free incoming messages */
+static void dhcp6_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
+
+/** Ensure DHCP PCB is allocated and bound */
+static err_t
+dhcp6_inc_pcb_refcount(void)
+{
+  if (dhcp6_pcb_refcount == 0) {
+    LWIP_ASSERT("dhcp6_inc_pcb_refcount(): memory leak", dhcp6_pcb == NULL);
+
+    /* allocate UDP PCB */
+    dhcp6_pcb = udp_new();
+
+    if (dhcp6_pcb == NULL) {
+      return ERR_MEM;
+    }
+
+    ip_set_option(dhcp6_pcb, SOF_BROADCAST);
+
+    /* set up local and remote port for the pcb -> listen on all interfaces on all src/dest IPs */
+    udp_bind(dhcp6_pcb, IP6_ADDR_ANY, DHCP6_CLIENT_PORT);
+    udp_recv(dhcp6_pcb, dhcp6_recv, NULL);
+  }
+
+  dhcp6_pcb_refcount++;
+
+  return ERR_OK;
+}
+
+/** Free DHCP PCB if the last netif stops using it */
+static void
+dhcp6_dec_pcb_refcount(void)
+{
+  LWIP_ASSERT("dhcp6_pcb_refcount(): refcount error", (dhcp6_pcb_refcount > 0));
+  dhcp6_pcb_refcount--;
+
+  if (dhcp6_pcb_refcount == 0) {
+    udp_remove(dhcp6_pcb);
+    dhcp6_pcb = NULL;
+  }
+}
+
+/**
+ * @ingroup dhcp6
+ * Set a statically allocated struct dhcp6 to work with.
+ * Using this prevents dhcp6_start to allocate it using mem_malloc.
+ *
+ * @param netif the netif for which to set the struct dhcp
+ * @param dhcp6 (uninitialised) dhcp6 struct allocated by the application
+ */
+void
+dhcp6_set_struct(struct netif *netif, struct dhcp6 *dhcp6)
+{
+  LWIP_ASSERT("netif != NULL", netif != NULL);
+  LWIP_ASSERT("dhcp6 != NULL", dhcp6 != NULL);
+  LWIP_ASSERT("netif already has a struct dhcp6 set", netif_dhcp6_data(netif) == NULL);
+
+  /* clear data structure */
+  memset(dhcp6, 0, sizeof(struct dhcp6));
+  /* dhcp_set_state(&dhcp, DHCP_STATE_OFF); */
+  netif_set_client_data(netif, LWIP_NETIF_CLIENT_DATA_INDEX_DHCP6, dhcp6);
+}
+
+/**
+ * @ingroup dhcp6
+ * Removes a struct dhcp6 from a netif.
+ *
+ * ATTENTION: Only use this when not using dhcp6_set_struct() to allocate the
+ *            struct dhcp6 since the memory is passed back to the heap.
+ *
+ * @param netif the netif from which to remove the struct dhcp
+ */
+void dhcp6_cleanup(struct netif *netif)
+{
+  LWIP_ASSERT("netif != NULL", netif != NULL);
+
+  if (netif_dhcp6_data(netif) != NULL) {
+    mem_free(netif_dhcp6_data(netif));
+    netif_set_client_data(netif, LWIP_NETIF_CLIENT_DATA_INDEX_DHCP6, NULL);
+  }
+}
+
+static struct dhcp6*
+dhcp6_get_struct(struct netif *netif, const char *dbg_requester)
+{
+  struct dhcp6 *dhcp6 = netif_dhcp6_data(netif);
+  if (dhcp6 == NULL) {
+    LWIP_DEBUGF(DHCP6_DEBUG | LWIP_DBG_TRACE, ("%s: mallocing new DHCPv6 client\n", dbg_requester));
+    dhcp6 = (struct dhcp6 *)mem_malloc(sizeof(struct dhcp6));
+    if (dhcp6 == NULL) {
+      LWIP_DEBUGF(DHCP6_DEBUG | LWIP_DBG_TRACE, ("%s: could not allocate dhcp6\n", dbg_requester));
+      return NULL;
+    }
+
+    /* clear data structure, this implies DHCP6_STATE_OFF */
+    memset(dhcp6, 0, sizeof(struct dhcp6));
+    /* store this dhcp6 client in the netif */
+    netif_set_client_data(netif, LWIP_NETIF_CLIENT_DATA_INDEX_DHCP6, dhcp6);
+  } else {
+    /* already has DHCP6 client attached */
+    LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_STATE, ("%s: using existing DHCPv6 client\n", dbg_requester));
+  }
+
+  if (!dhcp6->pcb_allocated) {
+    if (dhcp6_inc_pcb_refcount() != ERR_OK) { /* ensure DHCP6 PCB is allocated */
+      mem_free(dhcp6);
+      netif_set_client_data(netif, LWIP_NETIF_CLIENT_DATA_INDEX_DHCP6, NULL);
+      return NULL;
+    }
+    LWIP_DEBUGF(DHCP6_DEBUG | LWIP_DBG_TRACE, ("%s: allocated dhcp6", dbg_requester));
+    dhcp6->pcb_allocated = 1;
+  }
+  return dhcp6;
+}
+
+static u32_t
+dhcp6_create_next_xid(struct netif *netif, struct dhcp6 dhcp6)
+{
+  LWIP_UNUSED_ARG(netif);
+  LWIP_UNUSED_ARG(dhcp6);
+}
+
+#if LWIP_IPV6_DHCP6_STATELESS
+static err_t
+dhcp_information_request(struct netif *netif, struct dhcp6 *dhcp6)
+{
+  struct dhcp *dhcp = netif_dhcp_data(netif);
+  err_t result = ERR_OK;
+  u16_t msecs;
+  u8_t i;
+  LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE, ("dhcp_discover()\n"));
+  ip4_addr_set_any(&dhcp->offered_ip_addr);
+  dhcp_set_state(dhcp, DHCP_STATE_SELECTING);
+  /* create and initialize the DHCP message header */
+  result = dhcp_create_msg(netif, dhcp, DHCP_DISCOVER);
+  if (result == ERR_OK) {
+    LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE, ("dhcp_discover: making request\n"));
+
+    dhcp_option(dhcp, DHCP_OPTION_MAX_MSG_SIZE, DHCP_OPTION_MAX_MSG_SIZE_LEN);
+    dhcp_option_short(dhcp, DHCP_MAX_MSG_LEN(netif));
+
+    dhcp_option(dhcp, DHCP_OPTION_PARAMETER_REQUEST_LIST, LWIP_ARRAYSIZE(dhcp_discover_request_options));
+    for (i = 0; i < LWIP_ARRAYSIZE(dhcp_discover_request_options); i++) {
+      dhcp_option_byte(dhcp, dhcp_discover_request_options[i]);
+    }
+    LWIP_HOOK_DHCP_APPEND_OPTIONS(netif, dhcp, DHCP_STATE_SELECTING, dhcp->msg_out, DHCP_DISCOVER);
+    dhcp_option_trailer(dhcp);
+
+    LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE, ("dhcp_discover: sendto(DISCOVER, IP_ADDR_BROADCAST, DHCP_SERVER_PORT)\n"));
+    udp_sendto_if_src(dhcp_pcb, dhcp->p_out, IP_ADDR_BROADCAST, DHCP_SERVER_PORT, netif, IP4_ADDR_ANY);
+    LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE, ("dhcp_discover: deleting()ing\n"));
+    dhcp_delete_msg(dhcp);
+    LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_STATE, ("dhcp_discover: SELECTING\n"));
+  } else {
+    LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_LEVEL_SERIOUS, ("dhcp_discover: could not allocate DHCP request\n"));
+  }
+  if (dhcp->tries < 255) {
+    dhcp->tries++;
+  }
+#if LWIP_DHCP_AUTOIP_COOP
+  if (dhcp->tries >= LWIP_DHCP_AUTOIP_COOP_TRIES && dhcp->autoip_coop_state == DHCP_AUTOIP_COOP_STATE_OFF) {
+    dhcp->autoip_coop_state = DHCP_AUTOIP_COOP_STATE_ON;
+    autoip_start(netif);
+  }
+#endif /* LWIP_DHCP_AUTOIP_COOP */
+  msecs = (u16_t)((dhcp->tries < 6 ? 1 << dhcp->tries : 60) * 1000);
+  dhcp->request_timeout = (u16_t)((msecs + DHCP_FINE_TIMER_MSECS - 1) / DHCP_FINE_TIMER_MSECS);
+  LWIP_DEBUGF(DHCP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_STATE, ("dhcp_discover(): set request timeout %"U16_F" msecs\n", msecs));
+  return result;
+}
+
+static err_t
+dhcp6_request_config(struct netif *netif)
+{
+  struct dhcp6 *dhcp6;
+
+  LWIP_ASSERT("netif != NULL", netif != NULL);
+
+  dhcp6 = dhcp6_get_struct(netif, "dhcp6_request_config()");
+  if (dhcp6 == NULL) {
+    return ERR_MEM;
+  }
+
+  /* if state is not idle, set a flag to send an information-request later? */
+  if (dhcp6->state != DHCP6_STATE_OFF) {
+    dhcp6->request_config_pending = 1;
+    return ERR_OK;
+  }
+
+  /* send Information-request and wait for answer; setup receive timeout */
+  dhcp_information_request(netif, dhcp6);
+
+  return ERR_OK;
+}
+#endif /* LWIP_IPV6_DHCP6_STATELESS */
+
+void
+dhcp6_nd6_ra_trigger(struct netif *netif, u8_t managed_addr_config, u8_t other_config)
+{
+  LWIP_UNUSED_ARG(managed_addr_config);
+  LWIP_UNUSED_ARG(other_config);
+
+#if LWIP_IPV6_DHCP6_STATELESS
+  if (other_config) {
+    dhcp6_request_config(netif);
+  }
+#endif /* LWIP_IPV6_DHCP6_STATELESS */
+}
+
+static void
+dhcp6_recv(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port)
+{
+  LWIP_UNUSED_ARG(arg);
+  LWIP_UNUSED_ARG(pcb);
+  LWIP_UNUSED_ARG(p);
+  LWIP_UNUSED_ARG(addr);
+  LWIP_UNUSED_ARG(port);
+
+}
 
 #endif /* LWIP_IPV6 && LWIP_IPV6_DHCP6 */
diff --git a/src/core/pbuf.c b/src/core/pbuf.c
index d09737b6..0a2d29d2 100644
--- a/src/core/pbuf.c
+++ b/src/core/pbuf.c
@@ -672,16 +672,15 @@ pbuf_free_header(struct pbuf *q, u16_t size)
   struct pbuf *p = q;
   u16_t free_left = size;
   while (free_left && p) {
-    s16_t free_len = (free_left > INT16_MAX ? INT16_MAX : (s16_t)free_left);
-    if (free_len >= p->len) {
+    if (free_left >= p->len) {
       struct pbuf *f = p;
       free_left = (u16_t)(free_left - p->len);
       p = p->next;
       f->next = 0;
       pbuf_free(f);
     } else {
-      pbuf_header(p, (s16_t)-free_len);
-      free_left = (u16_t)(free_left - free_len);
+      pbuf_remove_header(p, free_left);
+      free_left = 0;
     }
   }
   return p;
diff --git a/src/netif/ethernet.c b/src/netif/ethernet.c
index 4a5f554b..65bcdc90 100644
--- a/src/netif/ethernet.c
+++ b/src/netif/ethernet.c
@@ -279,7 +279,7 @@ ethernet_output(struct netif* netif, struct pbuf* p,
 
     LWIP_ASSERT("prio_vid must be <= 0xFFFF", vlan_prio_vid <= 0xFFFF);
 
-    if (pbuf_header(p, SIZEOF_ETH_HDR + SIZEOF_VLAN_HDR) != 0) {
+    if (pbuf_add_header(p, SIZEOF_ETH_HDR + SIZEOF_VLAN_HDR) != 0) {
       goto pbuf_header_failed;
     }
     vlanhdr = (struct eth_vlan_hdr*)(((u8_t*)p->payload) + SIZEOF_ETH_HDR);
@@ -290,7 +290,7 @@ ethernet_output(struct netif* netif, struct pbuf* p,
   } else
 #endif /* ETHARP_SUPPORT_VLAN && defined(LWIP_HOOK_VLAN_SET) */
   {
-    if (pbuf_header(p, SIZEOF_ETH_HDR) != 0) {
+    if (pbuf_add_header(p, SIZEOF_ETH_HDR) != 0) {
       goto pbuf_header_failed;
     }
   }
diff --git a/src/netif/ppp/mppe.c b/src/netif/ppp/mppe.c
index 331039f8..e546f7cd 100644
--- a/src/netif/ppp/mppe.c
+++ b/src/netif/ppp/mppe.c
@@ -207,7 +207,7 @@ mppe_compress(ppp_pcb *pcb, ppp_mppe_state *state, struct pbuf **pb, u16_t proto
 	}
 
 	/* Hide MPPE header + protocol */
-	pbuf_header(np, -(s16_t)(MPPE_OVHD + sizeof(protocol)));
+	pbuf_remove_header(np, MPPE_OVHD + sizeof(protocol));
 
 	if ((err = pbuf_copy(np, *pb)) != ERR_OK) {
 		pbuf_free(np);
@@ -215,7 +215,7 @@ mppe_compress(ppp_pcb *pcb, ppp_mppe_state *state, struct pbuf **pb, u16_t proto
 	}
 
 	/* Reveal MPPE header + protocol */
-	pbuf_header(np, (s16_t)(MPPE_OVHD + sizeof(protocol)));
+	pbuf_add_header(np, MPPE_OVHD + sizeof(protocol));
 
 	*pb = np;
 	pl = (u8_t*)np->payload;
@@ -246,7 +246,7 @@ mppe_compress(ppp_pcb *pcb, ppp_mppe_state *state, struct pbuf **pb, u16_t proto
 	pl[1] = protocol;
 
 	/* Hide MPPE header */
-	pbuf_header(np, -(s16_t)MPPE_OVHD);
+	pbuf_remove_header(np, MPPE_OVHD);
 
 	/* Encrypt packet */
 	for (n = np; n != NULL; n = n->next) {
@@ -382,7 +382,7 @@ mppe_decompress(ppp_pcb *pcb, ppp_mppe_state *state, struct pbuf **pb)
 	}
 
 	/* Hide MPPE header */
-	pbuf_header(n0, -(s16_t)(MPPE_OVHD));
+	pbuf_remove_header(n0, MPPE_OVHD);
 
 	/* Decrypt the packet. */
 	for (n = n0; n != NULL; n = n->next) {
diff --git a/src/netif/ppp/ppp.c b/src/netif/ppp/ppp.c
index 9009a8d6..87e278ea 100644
--- a/src/netif/ppp/ppp.c
+++ b/src/netif/ppp/ppp.c
@@ -784,7 +784,7 @@ void ppp_input(ppp_pcb *pcb, struct pbuf *pb) {
   ppp_dump_packet(pcb, "rcvd", (unsigned char *)pb->payload, pb->len);
 #endif /* PRINTPKT_SUPPORT */
 
-  pbuf_header(pb, -(s16_t)sizeof(protocol));
+  pbuf_remove_header(pb, sizeof(protocol));
 
   LINK_STATS_INC(link.recv);
   MIB2_STATS_NETIF_INC(pcb->netif, ifinucastpkts);
@@ -860,10 +860,10 @@ void ppp_input(ppp_pcb *pcb, struct pbuf *pb) {
     pl = (u8_t*)pb->payload;
     if (pl[0] & 0x01) {
       protocol = pl[0];
-      pbuf_header(pb, -(s16_t)1);
+      pbuf_remove_header(pb, 1);
     } else {
       protocol = (pl[0] << 8) | pl[1];
-      pbuf_header(pb, -(s16_t)2);
+      pbuf_remove_header(pb, 2);
     }
   }
 #endif /* CCP_SUPPORT */
diff --git a/src/netif/ppp/pppoe.c b/src/netif/ppp/pppoe.c
index 68e9e84b..ba21913e 100644
--- a/src/netif/ppp/pppoe.c
+++ b/src/netif/ppp/pppoe.c
@@ -210,7 +210,7 @@ static err_t pppoe_write(ppp_pcb *ppp, void *ctx, struct pbuf *p) {
 #endif /* MIB2_STATS */
 
   /* skip address & flags */
-  pbuf_header(p, -(s16_t)2);
+  pbuf_remove_header(p, 2);
 
   ph = pbuf_alloc(PBUF_LINK, (u16_t)(PPPOE_HEADERLEN), PBUF_RAM);
   if(!ph) {
@@ -221,7 +221,7 @@ static err_t pppoe_write(ppp_pcb *ppp, void *ctx, struct pbuf *p) {
     return ERR_MEM;
   }
 
-  pbuf_header(ph, -(s16_t)PPPOE_HEADERLEN); /* hide PPPoE header */
+  pbuf_remove_header(ph, PPPOE_HEADERLEN); /* hide PPPoE header */
   pbuf_cat(ph, p);
 #if MIB2_STATS
   tot_len = ph->tot_len;
@@ -261,7 +261,7 @@ static err_t pppoe_netif_output(ppp_pcb *ppp, void *ctx, struct pbuf *p, u_short
     return ERR_MEM;
   }
 
-  pbuf_header(pb, -(s16_t)PPPOE_HEADERLEN);
+  pbuf_remove_header(pb, PPPOE_HEADERLEN);
 
   pl = (u8_t*)pb->payload;
   PUTSHORT(protocol, pl);
@@ -660,7 +660,7 @@ pppoe_data_input(struct netif *netif, struct pbuf *pb)
 #ifdef PPPOE_TERM_UNKNOWN_SESSIONS
   MEMCPY(shost, ((struct eth_hdr *)pb->payload)->src.addr, sizeof(shost));
 #endif
-  if (pbuf_header(pb, -(s16_t)sizeof(struct eth_hdr)) != 0) {
+  if (pbuf_remove_header(pb, sizeof(struct eth_hdr)) != 0) {
     /* bail out */
     PPPDEBUG(LOG_ERR, ("pppoe_data_input: pbuf_header failed\n"));
     LINK_STATS_INC(link.lenerr);
@@ -693,7 +693,7 @@ pppoe_data_input(struct netif *netif, struct pbuf *pb)
 
   plen = lwip_ntohs(ph->plen);
 
-  if (pbuf_header(pb, -(s16_t)(PPPOE_HEADERLEN)) != 0) {
+  if (pbuf_remove_header(pb, PPPOE_HEADERLEN) != 0) {
     /* bail out */
     PPPDEBUG(LOG_ERR, ("pppoe_data_input: pbuf_header PPPOE_HEADERLEN failed\n"));
     LINK_STATS_INC(link.lenerr);
diff --git a/src/netif/ppp/pppol2tp.c b/src/netif/ppp/pppol2tp.c
index 742aaa3c..d5087f8d 100644
--- a/src/netif/ppp/pppol2tp.c
+++ b/src/netif/ppp/pppol2tp.c
@@ -181,7 +181,7 @@ static err_t pppol2tp_write(ppp_pcb *ppp, void *ctx, struct pbuf *p) {
     return ERR_MEM;
   }
 
-  pbuf_header(ph, -(s16_t)PPPOL2TP_OUTPUT_DATA_HEADER_LEN); /* hide L2TP header */
+  pbuf_remove_header(ph, PPPOL2TP_OUTPUT_DATA_HEADER_LEN); /* hide L2TP header */
   pbuf_cat(ph, p);
 #if MIB2_STATS
   tot_len = ph->tot_len;
@@ -221,7 +221,7 @@ static err_t pppol2tp_netif_output(ppp_pcb *ppp, void *ctx, struct pbuf *p, u_sh
     return ERR_MEM;
   }
 
-  pbuf_header(pb, -(s16_t)PPPOL2TP_OUTPUT_DATA_HEADER_LEN);
+  pbuf_remove_header(pb, PPPOL2TP_OUTPUT_DATA_HEADER_LEN);
 
   pl = (u8_t*)pb->payload;
   PUTSHORT(protocol, pl);
@@ -434,7 +434,7 @@ static void pppol2tp_input(void *arg, struct udp_pcb *pcb, struct pbuf *p, const
   /* printf("HLEN = %d\n", hlen); */
 
   /* skip L2TP header */
-  if (pbuf_header(p, -(s16_t)hlen) != 0) {
+  if (pbuf_remove_header(p, hlen) != 0) {
     goto free_and_return;
   }
 
@@ -469,7 +469,7 @@ static void pppol2tp_input(void *arg, struct udp_pcb *pcb, struct pbuf *p, const
   if (p->len >= 2) {
     GETSHORT(hflags, inp);
     if (hflags == 0xff03) {
-      pbuf_header(p, -(s16_t)2);
+      pbuf_remove_header(p, 2);
     }
   }
   /* Dispatch the packet thereby consuming it. */
@@ -654,7 +654,7 @@ skipavp:
 nextavp:
     /* printf("AVP Found, vendor=%d, attribute=%d, len=%d\n", vendorid, attributetype, avplen); */
     /* next AVP */
-    if (pbuf_header(p, -(s16_t)(avplen + sizeof(avpflags) + sizeof(vendorid) + sizeof(attributetype)) ) != 0) {
+    if (pbuf_remove_header(p, avplen + sizeof(avpflags) + sizeof(vendorid) + sizeof(attributetype)) != 0) {
       return;
     }
   }
diff --git a/src/netif/ppp/pppos.c b/src/netif/ppp/pppos.c
index e0f0d26f..06aed761 100644
--- a/src/netif/ppp/pppos.c
+++ b/src/netif/ppp/pppos.c
@@ -547,7 +547,7 @@ pppos_input(ppp_pcb *ppp, u8_t *s, int l)
           pppos->in_tail = NULL;
 #if IP_FORWARD || LWIP_IPV6_FORWARD
           /* hide the room for Ethernet forwarding header */
-          pbuf_header(inp, -(s16_t)(PBUF_LINK_ENCAPSULATION_HLEN + PBUF_LINK_HLEN));
+          pbuf_remove_header(inp, PBUF_LINK_ENCAPSULATION_HLEN + PBUF_LINK_HLEN);
 #endif /* IP_FORWARD || LWIP_IPV6_FORWARD */
 #if PPP_INPROC_IRQ_SAFE
           if(tcpip_try_callback(pppos_input_callback, inp) != ERR_OK) {
@@ -704,7 +704,7 @@ static void pppos_input_callback(void *arg) {
   ppp_pcb *ppp;
 
   ppp = ((struct pppos_input_header*)pb->payload)->ppp;
-  if(pbuf_header(pb, -(s16_t)sizeof(struct pppos_input_header))) {
+  if(pbuf_remove_header(pb, sizeof(struct pppos_input_header))) {
     LWIP_ASSERT("pbuf_header failed\n", 0);
     goto drop;
   }
diff --git a/src/netif/ppp/vj.c b/src/netif/ppp/vj.c
index 90f620f0..73d20376 100644
--- a/src/netif/ppp/vj.c
+++ b/src/netif/ppp/vj.c
@@ -407,7 +407,7 @@ vj_compress_tcp(struct vjcompress *comp, struct pbuf **pb)
   if (!comp->compressSlot || comp->last_xmit != cs->cs_id) {
     comp->last_xmit = cs->cs_id;
     hlen -= deltaS + 4;
-    if (pbuf_header(np, -(s16_t)hlen)){
+    if (pbuf_remove_header(np, hlen)){
       /* Can we cope with this failing?  Just assert for now */
       LWIP_ASSERT("pbuf_header failed\n", 0);
     }
@@ -416,7 +416,7 @@ vj_compress_tcp(struct vjcompress *comp, struct pbuf **pb)
     *cp++ = cs->cs_id;
   } else {
     hlen -= deltaS + 3;
-    if (pbuf_header(np, -(s16_t)hlen)) {
+    if (pbuf_remove_header(np, hlen)) {
       /* Can we cope with this failing?  Just assert for now */
       LWIP_ASSERT("pbuf_header failed\n", 0);
     }
@@ -619,7 +619,7 @@ vj_uncompress_tcp(struct pbuf **nb, struct vjcompress *comp)
   IPH_CHKSUM_SET(&cs->cs_ip,  (u16_t)(~tmp));
 
   /* Remove the compressed header and prepend the uncompressed header. */
-  if (pbuf_header(n0, -(s16_t)vjlen)) {
+  if (pbuf_remove_header(n0, vjlen)) {
     /* Can we cope with this failing?  Just assert for now */
     LWIP_ASSERT("pbuf_header failed\n", 0);
     goto bad;
@@ -642,7 +642,7 @@ vj_uncompress_tcp(struct pbuf **nb, struct vjcompress *comp)
       goto bad;
     }
 
-    if (pbuf_header(np, -(s16_t)cs->cs_hlen)) {
+    if (pbuf_remove_header(np, cs->cs_hlen)) {
       /* Can we cope with this failing?  Just assert for now */
       LWIP_ASSERT("pbuf_header failed\n", 0);
       goto bad;
@@ -658,7 +658,7 @@ vj_uncompress_tcp(struct pbuf **nb, struct vjcompress *comp)
     n0 = np;
   }
 
-  if (pbuf_header(n0, (s16_t)cs->cs_hlen)) {
+  if (pbuf_add_header(n0, cs->cs_hlen)) {
     struct pbuf *np;
 
     LWIP_ASSERT("vj_uncompress_tcp: cs->cs_hlen <= PBUF_POOL_BUFSIZE", cs->cs_hlen <= PBUF_POOL_BUFSIZE);