diff --git a/dispatch.c b/dispatch.c
index 0b3ea614e..6e4c501e0 100644
--- a/dispatch.c
+++ b/dispatch.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dispatch.c,v 1.31 2017/05/31 07:00:13 markus Exp $ */
+/* $OpenBSD: dispatch.c,v 1.32 2019/01/19 21:33:13 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -47,7 +47,7 @@ dispatch_protocol_error(int type, u_int32_t seq, struct ssh *ssh)
 	    (r = sshpkt_put_u32(ssh, seq)) != 0 ||
 	    (r = sshpkt_send(ssh)) != 0 ||
 	    (r = ssh_packet_write_wait(ssh)) != 0)
-		sshpkt_fatal(ssh, __func__, r);
+		sshpkt_fatal(ssh, r, "%s", __func__);
 	return 0;
 }
 
@@ -131,5 +131,5 @@ ssh_dispatch_run_fatal(struct ssh *ssh, int mode, volatile sig_atomic_t *done)
 	int r;
 
 	if ((r = ssh_dispatch_run(ssh, mode, done)) != 0)
-		sshpkt_fatal(ssh, __func__, r);
+		sshpkt_fatal(ssh, r, "%s", __func__);
 }
diff --git a/opacket.c b/opacket.c
index 56a76939e..e5ccf8099 100644
--- a/opacket.c
+++ b/opacket.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: opacket.c,v 1.7 2017/10/20 01:56:39 djm Exp $ */
+/* $OpenBSD: opacket.c,v 1.9 2019/01/19 21:33:14 djm Exp $ */
 /* Written by Markus Friedl. Placed in the public domain.  */
 
 #include "includes.h"
@@ -238,7 +238,7 @@ packet_read_seqnr(u_int32_t *seqnr)
 	int r;
 
 	if ((r = ssh_packet_read_seqnr(active_state, &type, seqnr)) != 0)
-		sshpkt_fatal(active_state, __func__, r);
+		sshpkt_fatal(active_state, r, "%s", __func__);
 	return type;
 }
 
@@ -249,7 +249,7 @@ packet_read_poll_seqnr(u_int32_t *seqnr)
 	int r;
 
 	if ((r = ssh_packet_read_poll_seqnr(active_state, &type, seqnr)))
-		sshpkt_fatal(active_state, __func__, r);
+		sshpkt_fatal(active_state, r, "%s", __func__);
 	return type;
 }
 
@@ -266,7 +266,7 @@ packet_process_incoming(const char *buf, u_int len)
 	int r;
 
 	if ((r = ssh_packet_process_incoming(active_state, buf, len)) != 0)
-		sshpkt_fatal(active_state, __func__, r);
+		sshpkt_fatal(active_state, r, "%s", __func__);
 }
 
 void
@@ -275,7 +275,7 @@ packet_write_wait(void)
 	int r;
 
 	if ((r = ssh_packet_write_wait(active_state)) != 0)
-		sshpkt_fatal(active_state, __func__, r);
+		sshpkt_fatal(active_state, r, "%s", __func__);
 }
 
 void
@@ -284,7 +284,7 @@ packet_write_poll(void)
 	int r;
 
 	if ((r = ssh_packet_write_poll(active_state)) != 0)
-		sshpkt_fatal(active_state, __func__, r);
+		sshpkt_fatal(active_state, r, "%s", __func__);
 }
 
 void
@@ -293,7 +293,7 @@ packet_read_expect(int expected_type)
 	int r;
 
 	if ((r = ssh_packet_read_expect(active_state, expected_type)) != 0)
-		sshpkt_fatal(active_state, __func__, r);
+		sshpkt_fatal(active_state, r, "%s", __func__);
 }
 
 void
diff --git a/packet.c b/packet.c
index ded5a3201..aa8be8c94 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.279 2019/01/04 03:23:00 djm Exp $ */
+/* $OpenBSD: packet.c,v 1.280 2019/01/19 21:33:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1809,10 +1809,10 @@ sshpkt_fmt_connection_id(struct ssh *ssh, char *s, size_t l)
 /*
  * Pretty-print connection-terminating errors and exit.
  */
-void
-sshpkt_fatal(struct ssh *ssh, const char *tag, int r)
+static void
+sshpkt_vfatal(struct ssh *ssh, int r, const char *fmt, va_list ap)
 {
-	char remote_id[512];
+	char *tag = NULL, remote_id[512];
 
 	sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
 
@@ -1846,6 +1846,11 @@ sshpkt_fatal(struct ssh *ssh, const char *tag, int r)
 		}
 		/* FALLTHROUGH */
 	default:
+		if (vasprintf(&tag, fmt, ap) == -1) {
+			ssh_packet_clear_keys(ssh);
+			logdie("%s: could not allocate failure message",
+			    __func__);
+		}
 		ssh_packet_clear_keys(ssh);
 		logdie("%s%sConnection %s %s: %s",
 		    tag != NULL ? tag : "", tag != NULL ? ": " : "",
@@ -1854,6 +1859,18 @@ sshpkt_fatal(struct ssh *ssh, const char *tag, int r)
 	}
 }
 
+void
+sshpkt_fatal(struct ssh *ssh, int r, const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	sshpkt_vfatal(ssh, r, fmt, ap);
+	/* NOTREACHED */
+	va_end(ap);
+	logdie("%s: should have exited", __func__);
+}
+
 /*
  * Logs the error plus constructs and sends a disconnect packet, closes the
  * connection, and exits.  This function never returns. The error message
@@ -1889,10 +1906,10 @@ ssh_packet_disconnect(struct ssh *ssh, const char *fmt,...)
 	 * for it to get sent.
 	 */
 	if ((r = sshpkt_disconnect(ssh, "%s", buf)) != 0)
-		sshpkt_fatal(ssh, __func__, r);
+		sshpkt_fatal(ssh, r, "%s", __func__);
 
 	if ((r = ssh_packet_write_wait(ssh)) != 0)
-		sshpkt_fatal(ssh, __func__, r);
+		sshpkt_fatal(ssh, r, "%s", __func__);
 
 	/* Close the connection. */
 	ssh_packet_close(ssh);
diff --git a/packet.h b/packet.h
index c58b52d39..74bb51108 100644
--- a/packet.h
+++ b/packet.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.h,v 1.87 2019/01/19 21:31:32 djm Exp $ */
+/* $OpenBSD: packet.h,v 1.88 2019/01/19 21:33:14 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -176,7 +176,8 @@ int	sshpkt_send(struct ssh *ssh);
 int     sshpkt_disconnect(struct ssh *, const char *fmt, ...)
 	    __attribute__((format(printf, 2, 3)));
 int	sshpkt_add_padding(struct ssh *, u_char);
-void	sshpkt_fatal(struct ssh *ssh, const char *tag, int r);
+void	sshpkt_fatal(struct ssh *ssh, int r, const char *fmt, ...)
+	    __attribute__((format(printf, 3, 4)));
 int	sshpkt_msg_ignore(struct ssh *, u_int);
 
 int	sshpkt_put(struct ssh *ssh, const void *v, size_t len);