diff --git a/src/send.go b/src/send.go
index fdbc676..ca42934 100644
--- a/src/send.go
+++ b/src/send.go
@@ -313,17 +313,15 @@ func (device *Device) RoutineEncryption() {
 			elem.packet = append(elem.packet, 0)
 		}
 
-		// encrypt content
+		// encrypt content (append to header)
 
 		binary.LittleEndian.PutUint64(nonce[4:], elem.nonce)
 		elem.packet = elem.keyPair.send.Seal(
-			elem.packet[:0],
+			header,
 			nonce[:],
 			elem.packet,
 			nil,
 		)
-		length := MessageTransportHeaderSize + len(elem.packet)
-		elem.packet = elem.buffer[:length]
 		elem.mutex.Unlock()
 
 		// refresh key if necessary
diff --git a/src/tun_linux.go b/src/tun_linux.go
index d0e9761..a200bd8 100644
--- a/src/tun_linux.go
+++ b/src/tun_linux.go
@@ -37,6 +37,8 @@ func (tun *NativeTun) setMTU(n int) error {
 		return err
 	}
 
+	defer syscall.Close(fd)
+
 	// do ioctl call
 
 	var ifr [64]byte
@@ -70,6 +72,8 @@ func (tun *NativeTun) MTU() (int, error) {
 		return 0, err
 	}
 
+	defer syscall.Close(fd)
+
 	// do ioctl call
 
 	var ifr [64]byte