diff --git a/NEWS b/NEWS
index dbc0f646f..eaa175ba7 100644
--- a/NEWS
+++ b/NEWS
@@ -320,7 +320,8 @@ To be released as 0.11.4.
 * bug 691: don't look up bogus IPv4 addresses based on characters of a
   hostname
 * bug 712: GnuTLS works on https://www-s.uiuc.edu/[]
-* fix passive FTP over IPv6 when connect() fails with EINPROGRESS
+* fix active and passive FTP over IPv6
+* bug 978: Python's webbrowser.open_new_tab(URL) works since now
 * minor bug 951 in user SMJS: garbage-collect SMJS objects on 'File ->
   Flush all caches' to work around their holding cache entries busy
 * minor bug 396: never show empty filename in the what-to-do dialog
@@ -328,6 +329,7 @@ To be released as 0.11.4.
 * minor bug 928: properly display no-break spaces in a UTF-8 document
   if the terminal uses some other charset
 * trivial bug 947: document.html.wrap_nbsp also affects text in tables
+* trivial bug 997: fix unlikely stack corruption in active FTP
 * build bug 950: fix ``config/install-sh: No such file or directory''
   on SunOS
 * build bug 936: fix errors about undefined off_t (autoheader
@@ -336,9 +338,10 @@ To be released as 0.11.4.
 * build: update SpiderMonkey configure check Debian compatibility
 * build: use $(CPPFLAGS) rather than $(AM_CFLAGS)
 * build: disable GCC 4.2 warning about builtin_modules
+* build: move debian/ to contrib/debian/
+* minor build bug 989: AsciiDoc 8.2.2 compatibility
 * minor build bug 960: fix errors in loadmsgcat.c if mmap() exists but
   munmap() doesn't
-* bug 978: Python's webbrowser.open_new_tab(URL) works since now
 
 //////////////////////////////////////////////////////////////////////
 The following changes should be removed from NEWS before ELinks 0.11.4
diff --git a/src/network/socket.c b/src/network/socket.c
index 1145bb1b8..304ba8f6f 100644
--- a/src/network/socket.c
+++ b/src/network/socket.c
@@ -282,6 +282,7 @@ get_pasv_socket(struct socket *ctrl_socket, struct sockaddr_storage *addr)
 	struct sockaddr *pasv_addr = (struct sockaddr *) addr;
 	size_t addrlen;
 	int sock = -1;
+	int syspf; /* Protocol Family given to system, not EL_PF_... */
 	socklen_t len;
 #ifdef CONFIG_IPV6
 	struct sockaddr_in6 bind_addr6;
@@ -289,15 +290,17 @@ get_pasv_socket(struct socket *ctrl_socket, struct sockaddr_storage *addr)
 	if (ctrl_socket->protocol_family == EL_PF_INET6) {
 		bind_addr = (struct sockaddr *) &bind_addr6;
 		addrlen   = sizeof(bind_addr6);
+		syspf     = PF_INET6;
 	} else
 #endif
 	{
 		bind_addr = (struct sockaddr *) &bind_addr4;
 		addrlen   = sizeof(bind_addr4);
+		syspf     = PF_INET;
 	}
 
-	memset(pasv_addr, 0, sizeof(addrlen));
-	memset(bind_addr, 0, sizeof(addrlen));
+	memset(pasv_addr, 0, addrlen);
+	memset(bind_addr, 0, addrlen);
 
 	/* Get our endpoint of the control socket */
 	len = addrlen;
@@ -310,7 +313,7 @@ sock_error:
 
 	/* Get a passive socket */
 
-	sock = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
+	sock = socket(syspf, SOCK_STREAM, IPPROTO_TCP);
 	if (sock < 0)
 		goto sock_error;