diff --git a/RELNOTES b/RELNOTES
index e9e4d1da..043869c5 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -129,6 +129,11 @@ work on other platforms. Please report any problems and suggested fixes to
   backwards compatible with older lease files not finding a semi-colon
   is also accepted.  [ISC-Bugs #22303].
 
+! Handle a relay forward message with an unspecified address in the
+  link address field.  Previously such a message would cause the
+  server to crash.  [ISC-Bugs #21992]
+  CERT: TBA CVE: TBA
+
 			Changes since 4.2.0b2
 
 - Add declaration for variable in debug code in alloc.c.  [ISC-Bugs #21472]
diff --git a/server/dhcpv6.c b/server/dhcpv6.c
index 7d6129df..50376b1a 100644
--- a/server/dhcpv6.c
+++ b/server/dhcpv6.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2009 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006-2010 by Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -4207,10 +4207,25 @@ shared_network_from_packet6(struct shared_network **shared,
 	 * If there is no link address, we will use the interface
 	 * that this packet came in on to pick the shared_network.
 	 */
-	} else {
+	} else if (packet->interface != NULL) {
 		status = shared_network_reference(shared,
 					 packet->interface->shared_network,
 					 MDL);
+                if (packet->dhcpv6_container_packet != NULL) {
+			log_info("[L2 Relay] No link address in relay packet "
+				 "assuming L2 relay and using receiving "
+				 "interface");
+                }
+
+	} else {
+		/*
+		 * We shouldn't be able to get here but if there is no link
+		 * address and no interface we don't know where to get the
+		 * pool from log an error and return an error.
+		 */
+		log_error("No interface and no link address " 
+			  "can't determine pool");
+		status = DHCP_R_INVALIDARG;
 	}
 
 	return status;
@@ -5508,6 +5523,7 @@ dhcpv6_relay_forw(struct data_string *reply_ret, struct packet *packet) {
 
 	enc_packet->client_port = packet->client_port;
 	enc_packet->client_addr = packet->client_addr;
+	interface_reference(&enc_packet->interface, packet->interface, MDL);
 	enc_packet->dhcpv6_container_packet = packet;
 
 	msg_type = enc_opt_data.data[0];