diff --git a/sys/netinet/in.c b/sys/netinet/in.c
index 84052a3913e..4d902eab8eb 100644
--- a/sys/netinet/in.c
+++ b/sys/netinet/in.c
@@ -794,7 +794,7 @@ in_addprefix(target, flags)
 	int flags;
 {
 	struct in_ifaddr *ia;
-	struct in_addr prefix, mask, p;
+	struct in_addr prefix, mask, p, m;
 	int error;
 
 	if ((flags & RTF_HOST) != 0)
@@ -806,15 +806,20 @@ in_addprefix(target, flags)
 	}
 
 	TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {
-		if (rtinitflags(ia))
-			p = ia->ia_dstaddr.sin_addr;
-		else {
+		if (rtinitflags(ia)) {
 			p = ia->ia_addr.sin_addr;
-			p.s_addr &= ia->ia_sockmask.sin_addr.s_addr;
-		}
 
-		if (prefix.s_addr != p.s_addr)
-			continue;
+			if (prefix.s_addr != p.s_addr)
+				continue;
+		} else {
+			p = ia->ia_addr.sin_addr;
+			m = ia->ia_sockmask.sin_addr;
+			p.s_addr &= m.s_addr;
+
+			if (prefix.s_addr != p.s_addr ||
+			    mask.s_addr != m.s_addr)
+				continue;
+		}
 
 		/*
 		 * If we got a matching prefix route inserted by other