diff --git a/ports/unix/netif/tunif.c b/ports/unix/netif/tunif.c
index 27a0cd6..fd3f024 100644
--- a/ports/unix/netif/tunif.c
+++ b/ports/unix/netif/tunif.c
@@ -143,7 +143,7 @@ low_level_output(struct tunif *tunif, struct pbuf *p)
        time. The size of the data in each pbuf is kept in the ->len
        variable. */
     /* send data from(q->payload, q->len); */
-    memcpy(q->payload, bufptr, q->len);
+    memcpy(bufptr, q->payload, q->len);
     bufptr += q->len;
   }
 
@@ -192,7 +192,7 @@ low_level_input(struct tunif *tunif)
          available data in the pbuf is given by the q->len
          variable. */
       /* read data into(q->payload, q->len); */
-      memcpy(bufptr, q->payload, q->len);
+      memcpy(q->payload, bufptr, q->len);
       bufptr += q->len;
     }
     /* acknowledge that packet has been read(); */
diff --git a/ports/unix/netif/unixif.c b/ports/unix/netif/unixif.c
index 0461f73..e615c0d 100644
--- a/ports/unix/netif/unixif.c
+++ b/ports/unix/netif/unixif.c
@@ -223,7 +223,7 @@ unixif_input_handler(void *data)
       bufptr = buf;
       q = p;
       while (rlen > 0) {
-        memcpy(bufptr, q->payload, rlen > q->len? q->len: rlen);
+        memcpy(q->payload, bufptr, rlen > q->len? q->len: rlen);
         rlen -= q->len;
         bufptr += q->len;
         q = q->next;