diff --git a/openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c b/openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c
index f8c4d70130033093e2b0834a6dde8a4ba98764cc..748f1526eb2b2a8cb9290b387abb05346f0bce5e 100644
--- a/openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c
+++ b/openair2/LAYER2/nr_pdcp/nr_pdcp_entity.c
@@ -77,7 +77,7 @@ static void nr_pdcp_entity_recv_pdu(nr_pdcp_entity_t *entity,
   }
 
   rx_deliv_sn  = entity->rx_deliv & entity->sn_max;
-  rx_deliv_hfn = (entity->rx_deliv >> entity->sn_size) & ~entity->sn_max;
+  rx_deliv_hfn = entity->rx_deliv >> entity->sn_size;
 
   if (rcvd_sn < rx_deliv_sn - entity->window_size) {
     rcvd_hfn = rx_deliv_hfn + 1;
diff --git a/openair2/LAYER2/nr_pdcp/nr_pdcp_security_nea2.c b/openair2/LAYER2/nr_pdcp/nr_pdcp_security_nea2.c
index fc07f661dd590ee486a2a5d850a2256a66e62ceb..52afe95673853799743e5511ea39c8fb112deb66 100644
--- a/openair2/LAYER2/nr_pdcp/nr_pdcp_security_nea2.c
+++ b/openair2/LAYER2/nr_pdcp/nr_pdcp_security_nea2.c
@@ -27,12 +27,21 @@
 #include <nettle/aes.h>
 #include <nettle/ctr.h>
 
+#ifndef NETTLE_VERSION_MAJOR
+/* hack: include bignum.h, not version.h because version.h does not exist
+ *       in old versions and bignum.h includes version.h (as of today).
+ *       May completely fail to work... maybe we should skip support of old
+ *       versions of nettle.
+ */
+#include <nettle/bignum.h>
+#endif
+
 void *nr_pdcp_security_nea2_init(unsigned char *ciphering_key)
 {
   void *ctx = calloc(1, nettle_aes128.context_size);
   if (ctx == NULL) exit(1);
 
-#if NETTLE_VERSION_MAJOR < 3
+#if !defined(NETTLE_VERSION_MAJOR) || NETTLE_VERSION_MAJOR < 3
   nettle_aes128.set_encrypt_key(ctx, 16, ciphering_key);
 #else
   nettle_aes128.set_encrypt_key(ctx, ciphering_key);