diff --git a/src/tlshd/quic.c b/src/tlshd/quic.c
index 55c36fa..76e9202 100644
--- a/src/tlshd/quic.c
+++ b/src/tlshd/quic.c
@@ -360,16 +360,21 @@ static int quic_session_set_priority(gnutls_session_t session, uint32_t cipher)
 static int quic_session_set_alpns(gnutls_session_t session, char *alpn_data)
 {
 	gnutls_datum_t alpns[TLSHD_QUIC_MAX_ALPNS_LEN / 2];
-	char *alpn = strtok(alpn_data, ",");
+	char *saveptr = NULL;
+	char *alpn = strtok_r(alpn_data, ",", &saveptr);
 	int count = 0, ret;
 
 	while (alpn) {
 		while (*alpn == ' ')
 			alpn++;
+		if (!*alpn) {
+			alpn = strtok_r(NULL, ",", &saveptr);
+			continue;
+		}
 		alpns[count].data = (unsigned char *)alpn;
 		alpns[count].size = strlen(alpn);
 		count++;
-		alpn = strtok(NULL, ",");
+		alpn = strtok_r(NULL, ",", &saveptr);
 	}
 
 	ret = gnutls_alpn_set_protocols(session, alpns, count, GNUTLS_ALPN_MANDATORY);
@@ -421,6 +426,7 @@ static int quic_conn_get_config(struct tlshd_quic_conn *conn)
 		tlshd_log_error("socket getsockopt alpn error %d", errno);
 		return -1;
 	}
+	conn->alpns[len] = '\0';
 	len = sizeof(conn->ticket);
 	if (getsockopt(sockfd, SOL_QUIC, QUIC_SOCKOPT_SESSION_TICKET, conn->ticket, &len)) {
 		tlshd_log_error("socket getsockopt session ticket error %d", errno);
diff --git a/src/tlshd/tags.c b/src/tlshd/tags.c
index 1a83c7c..0491ca6 100644
--- a/src/tlshd/tags.c
+++ b/src/tlshd/tags.c
@@ -1433,7 +1433,7 @@ tlshd_tags_filter_type_match_x509_tbs_version(struct tlshd_tags_filter *filter,
 		goto deinit;
 	}
 
-	snprintf(version, sizeof(version), "%u", ret);
+	snprintf(version, sizeof(version), "%d", ret);
 	res = tlshd_tags_filter_type_match_string(filter, version);
 	tlshd_log_debug("Filter '%s' %s version '%s'",
 			filter->fi_name,
diff --git a/src/tlshd/tlshd.h b/src/tlshd/tlshd.h
index b7d3e8a..bc86bce 100644
--- a/src/tlshd/tlshd.h
+++ b/src/tlshd/tlshd.h
@@ -219,7 +219,8 @@ struct tlshd_quic_msg {
  */
 struct tlshd_quic_conn {
 	struct tlshd_handshake_parms *parms;
-	char alpns[TLSHD_QUIC_MAX_ALPNS_LEN];
+	/* one byte larger than the kernel maximum, to hold the NUL */
+	char alpns[TLSHD_QUIC_MAX_ALPNS_LEN + 1];
 	uint8_t ticket[TLSHD_QUIC_MAX_DATA_LEN];
 	uint32_t ticket_len;
 	uint32_t cipher;