diff --git a/sys/include/net/ng_pktbuf.h b/sys/include/net/ng_pktbuf.h
index f790399865..10d237d83b 100644
--- a/sys/include/net/ng_pktbuf.h
+++ b/sys/include/net/ng_pktbuf.h
@@ -141,6 +141,8 @@ void ng_pktbuf_hold(ng_pktsnip_t *pkt, unsigned int num);
  * @brief   Decreases ng_pktsnip_t::users of @p pkt atomically and removes it if it
  *          reaches 0.
  *
+ * @pre All snips of @p pkt must be in the packet buffer.
+ *
  * @param[in] pkt   A packet.
  */
 void ng_pktbuf_release(ng_pktsnip_t *pkt);
diff --git a/sys/net/crosslayer/ng_pktbuf_static/ng_pktbuf_static.c b/sys/net/crosslayer/ng_pktbuf_static/ng_pktbuf_static.c
index 20cc35a7b1..5fe61ed7b4 100644
--- a/sys/net/crosslayer/ng_pktbuf_static/ng_pktbuf_static.c
+++ b/sys/net/crosslayer/ng_pktbuf_static/ng_pktbuf_static.c
@@ -198,7 +198,9 @@ void ng_pktbuf_release(ng_pktsnip_t *pkt)
 {
     mutex_lock(&_mutex);
     while (pkt) {
-        ng_pktsnip_t *tmp = pkt->next;
+        ng_pktsnip_t *tmp;
+        assert(_pktbuf_contains(pkt));
+        tmp = pkt->next;
         if (pkt->users == 1) {
             pkt->users = 0; /* not necessary but to be on the safe side */
             _pktbuf_free(pkt->data, pkt->size);