diff --git a/net/dns/manager.go b/net/dns/manager.go
index 7bccb45d2..2fc54492e 100644
--- a/net/dns/manager.go
+++ b/net/dns/manager.go
@@ -64,7 +64,7 @@ const reconfigTimeout = time.Second
 
 type response struct {
 	pkt  []byte
-	from netaddr.IPPort // where the packet needs to be sent
+	to netaddr.IPPort // response destination (request source)
 }
 
 // Manager manages system DNS settings.
@@ -282,27 +282,27 @@ func (m *Manager) NextPacket() ([]byte, error) {
 
 	var buf []byte
 	switch {
-	case resp.from.IP().Is4():
+	case resp.to.IP().Is4():
 		h := packet.UDP4Header{
 			IP4Header: packet.IP4Header{
 				Src: magicDNSIP,
-				Dst: resp.from.IP(),
+				Dst: resp.to.IP(),
 			},
 			SrcPort: 53,
-			DstPort: resp.from.Port(),
+			DstPort: resp.to.Port(),
 		}
 		hlen := h.Len()
 		buf = make([]byte, offset+hlen+len(resp.pkt))
 		copy(buf[offset+hlen:], resp.pkt)
 		h.Marshal(buf[offset:])
-	case resp.from.IP().Is6():
+	case resp.to.IP().Is6():
 		h := packet.UDP6Header{
 			IP6Header: packet.IP6Header{
 				Src: magicDNSIPv6,
-				Dst: resp.from.IP(),
+				Dst: resp.to.IP(),
 			},
 			SrcPort: 53,
-			DstPort: resp.from.Port(),
+			DstPort: resp.to.Port(),
 		}
 		hlen := h.Len()
 		buf = make([]byte, offset+hlen+len(resp.pkt))
diff --git a/net/tstun/wrap.go b/net/tstun/wrap.go
index 168092711..400553b6a 100644
--- a/net/tstun/wrap.go
+++ b/net/tstun/wrap.go
@@ -692,7 +692,7 @@ func (t *Wrapper) SetFilter(filt *filter.Filter) {
 	t.filter.Store(filt)
 }
 
-// InjectInboundDirect makes the Wrapper device behave as if a packet
+// InjectInboundPacketBuffer makes the Wrapper device behave as if a packet
 // with the given contents was received from the network.
 // It takes ownership of one reference count on the packet. The injected
 // packet will not pass through inbound filters.
@@ -706,7 +706,7 @@ func (t *Wrapper) InjectInboundPacketBuffer(pkt *stack.PacketBuffer) error {
 	n += copy(buf[PacketStartOffset+n:], pkt.TransportHeader().View())
 	n += copy(buf[PacketStartOffset+n:], pkt.Data().AsRange().AsView())
 	if n != pkt.Size() {
-		panic("unexpected: revisit assumptions")
+		panic("unexpected packet size after copy")
 	}
 	pkt.DecRef()
 
diff --git a/tsnet/tsnet.go b/tsnet/tsnet.go
index f000825f2..ddde30a83 100644
--- a/tsnet/tsnet.go
+++ b/tsnet/tsnet.go
@@ -196,12 +196,12 @@ func (s *Server) start() error {
 		return err
 	}
 
-	tunDev, magicConn, d, ok := eng.(wgengine.InternalsGetter).GetInternals()
+	tunDev, magicConn, dns, ok := eng.(wgengine.InternalsGetter).GetInternals()
 	if !ok {
 		return fmt.Errorf("%T is not a wgengine.InternalsGetter", eng)
 	}
 
-	ns, err := netstack.Create(logf, tunDev, eng, magicConn, s.dialer, d)
+	ns, err := netstack.Create(logf, tunDev, eng, magicConn, s.dialer, dns)
 	if err != nil {
 		return fmt.Errorf("netstack.Create: %w", err)
 	}
diff --git a/wgengine/netstack/netstack_test.go b/wgengine/netstack/netstack_test.go
index b5aac19d5..12dbe567e 100644
--- a/wgengine/netstack/netstack_test.go
+++ b/wgengine/netstack/netstack_test.go
@@ -39,12 +39,12 @@ func TestInjectInboundLeak(t *testing.T) {
 	if !ok {
 		t.Fatal("not an InternalsGetter")
 	}
-	tunWrap, magicSock, d, ok := ig.GetInternals()
+	tunWrap, magicSock, dns, ok := ig.GetInternals()
 	if !ok {
 		t.Fatal("failed to get internals")
 	}
 
-	ns, err := Create(logf, tunWrap, eng, magicSock, dialer, d)
+	ns, err := Create(logf, tunWrap, eng, magicSock, dialer, dns)
 	if err != nil {
 		t.Fatal(err)
 	}