diff --git a/FEE/smile_fee_cfg.h b/FEE/smile_fee_cfg.h
index ea22308465746dce6beed48917f1c0a2053e6100..9db20b1654a80d1c61083f2cd6d866540f6ad682 100644
--- a/FEE/smile_fee_cfg.h
+++ b/FEE/smile_fee_cfg.h
@@ -22,17 +22,17 @@
 #include <stdint.h>
 
 
-#define DPU_ADDR	0x28
-#define FEE_ADDR	0x5A
+#define DPU_ADDR	0x50
+#define FEE_ADDR	0x51
 
+#define DPATH	{1}
+#define RPATH	{0, 0, 0, 33}
 
-#define DPATH	{FEE_ADDR}
-#define RPATH	{0x00, 0x00, 0x00, DPU_ADDR}
-#define DPATH_LEN	1
-#define RPATH_LEN	4
+#define DPATH_LEN	0
+#define RPATH_LEN	0
 
 /* default FEE destkey */
-#define FEE_DEST_KEY	0x0
+#define FEE_DEST_KEY	0xD1
 
 
 /* set header size maximum so we can fit the largest possible rmap commands
diff --git a/FEE/smile_fee_rmap.c b/FEE/smile_fee_rmap.c
index 8af0d3a90b7fb6afcec2f44b7cae163fc2003ec7..71fddf8fce830dae19bb4e2da2a750a81c8f4287 100644
--- a/FEE/smile_fee_rmap.c
+++ b/FEE/smile_fee_rmap.c
@@ -528,6 +528,8 @@ int smile_fee_package(uint8_t *blob,
 	case RMAP_WRITE_ADDR_INC:
 	case RMAP_WRITE_ADDR_SINGLE_VERIFY:
 	case RMAP_WRITE_ADDR_INC_VERIFY:
+	case RMAP_WRITE_ADDR_SINGLE_VERIFY_REPLY:
+	case RMAP_WRITE_ADDR_INC_VERIFY_REPLY:
 		has_data_crc = 1;
 		n += 1;
 		break;
@@ -631,6 +633,9 @@ int smile_fee_set_return_path(uint8_t *path, uint8_t len)
 	if (len > RMAP_MAX_REPLY_PATH_LEN)
 		return -1;
 
+	if (len & 0x3)
+		return -1;	/* not a multiple of 4 */
+
 	if (!path || !len) {
 		rpath     = NULL;
 		rpath_len = 0;