diff --git a/RNS/Packet.py b/RNS/Packet.py
index 9357adc0..74712b77 100755
--- a/RNS/Packet.py
+++ b/RNS/Packet.py
@@ -272,12 +272,14 @@ class Packet:
                 self.data = self.raw[DST_LEN+3:]
                 if len(self.destination_hash) != DST_LEN: raise ValueError("Malformed destination hash field")
 
+            if len(self.data) == 0: raise ValueError("Zero-length data field")
+
             self.packed = False
             self.update_hash()
             return True
 
         except Exception as e:
-            RNS.log(f"Received malformed packet, dropping it. The contained exception was: {e}", RNS.LOG_EXTREME) if RNS.sl(RNS.LOG_EXTREME) else None
+            RNS.log(f"Received malformed packet, dropping it. The contained exception was: {e}", RNS.LOG_DEBUG) if RNS.sl(RNS.LOG_DEBUG) else None
             return False
 
     def send(self):
diff --git a/RNS/Transport.py b/RNS/Transport.py
index 97630dc0..66738c65 100755
--- a/RNS/Transport.py
+++ b/RNS/Transport.py
@@ -1796,7 +1796,8 @@ class Transport:
 
         # Ingress limit announces early
         if packet.packet_type == RNS.Packet.ANNOUNCE:
-            if not tc: traffic_class = Transport.TC_ANNOUNCE
+            if len(raw) > RNS.Reticulum.MTU: return packet.receiving_interface.protocol_violation(f"Excessive announce packet frame size of {len(raw)} bytes") if packet.receiving_interface else None
+            if traffic_class < Transport.TC_ANNOUNCE: traffic_class = Transport.TC_ANNOUNCE
             announce_signature_valid = RNS.Identity.validate_announce(packet, only_validate_signature=True, signal_blackholed=True)
             if announce_signature_valid == "blackholed": return None
             elif not announce_signature_valid:
@@ -1820,7 +1821,7 @@ class Transport:
 
         # Ingress limit path requests early
         elif packet.destination_hash == Transport.pr_destination_hash:
-            traffic_class = Transport.TC_PATH_REQUEST
+            if traffic_class < Transport.TC_PATH_REQUEST: traffic_class = Transport.TC_PATH_REQUEST
             if not len(packet.data) >= RNS.Identity.TRUNCATED_HASHLENGTH//8: return
             else:
                 tag_bytes = None