Fix two ASAN crashes for `pf`