diff --git a/src/netif/ppp/ppp.c b/src/netif/ppp/ppp.c
index 6b2b2bd1..6c070483 100644
--- a/src/netif/ppp/ppp.c
+++ b/src/netif/ppp/ppp.c
@@ -779,8 +779,10 @@ void ppp_link_end(ppp_pcb *pcb) {
 void ppp_input(ppp_pcb *pcb, struct pbuf *pb) {
   u16_t protocol;
 #if PPP_DEBUG && PPP_PROTOCOLNAME
-    const char *pname;
+  const char *pname;
 #endif /* PPP_DEBUG && PPP_PROTOCOLNAME */
+  LWIP_ASSERT("pcb->phase >= PPP_PHASE_ESTABLISH && pcb->phase <= PPP_PHASE_TERMINATE",
+    pcb->phase >= PPP_PHASE_ESTABLISH && pcb->phase <= PPP_PHASE_TERMINATE);
 
   magic_randomize();
 
diff --git a/src/netif/ppp/pppos.c b/src/netif/ppp/pppos.c
index b77bf134..f8ae8366 100644
--- a/src/netif/ppp/pppos.c
+++ b/src/netif/ppp/pppos.c
@@ -744,6 +744,7 @@ pppos_input(ppp_pcb *ppp, const void *s, int l)
 static void pppos_input_callback(void *arg) {
   struct pbuf *pb = (struct pbuf*)arg;
   ppp_pcb *ppp;
+  pppos_pcb *pppos;
 
   ppp = ((struct pppos_input_header*)pb->payload)->ppp;
   if(pbuf_remove_header(pb, sizeof(struct pppos_input_header))) {
@@ -751,6 +752,16 @@ static void pppos_input_callback(void *arg) {
     goto drop;
   }
 
+  /* A previous call to ppp_input might have disconnected the session
+   * while there were still packets in flight in the tcpip mailbox.
+   * Drop incoming packets because ppp_input must never be called if
+   * the upper layer is down.
+   */
+  pppos = (pppos_pcb *)ppp->link_ctx_cb;
+  if (!pppos->open) {
+    goto drop;
+  }
+
   /* Dispatch the packet thereby consuming it. */
   ppp_input(ppp, pb);
   return;