diff --git a/lib/core/ogs-3gpp-types.h b/lib/core/ogs-3gpp-types.h
index d29ebb636..5a6c54631 100644
--- a/lib/core/ogs-3gpp-types.h
+++ b/lib/core/ogs-3gpp-types.h
@@ -511,12 +511,12 @@ typedef struct ogs_pco_ipcp_options_s {
     uint32_t addr;
 } __attribute__ ((packed)) ogs_pco_ipcp_options_t;
 
-#define OGS_PCO_MAX_NUM_OF_IPCO_OPTIONS 4
+#define OGS_PCO_MAX_NUM_OF_IPCP_OPTIONS 4
 typedef struct ogs_pco_ipcp_s {
     uint8_t code;
     uint8_t identifier;
     uint16_t len;
-    ogs_pco_ipcp_options_t options[OGS_PCO_MAX_NUM_OF_IPCO_OPTIONS];
+    ogs_pco_ipcp_options_t options[OGS_PCO_MAX_NUM_OF_IPCP_OPTIONS];
 } __attribute__ ((packed)) ogs_pco_ipcp_t;
 
 typedef struct ogs_pco_pap_s {
diff --git a/src/smf/context.c b/src/smf/context.c
index 739a299ab..c1e59d832 100644
--- a/src/smf/context.c
+++ b/src/smf/context.c
@@ -2479,7 +2479,9 @@ int smf_pco_build(uint8_t *pco_buf, uint8_t *buffer, int length)
     ogs_pco_t ue, smf;
     ogs_pco_pap_t pco_pap;
     ogs_pco_chap_t pco_chap;
-    ogs_pco_ipcp_t pco_ipcp;
+#define OGS_PCO_MAX_NUM_OF_IPCP 4
+    ogs_pco_ipcp_t pco_ipcp[OGS_PCO_MAX_NUM_OF_IPCP];
+    int num_of_ipcp;
     int pco_size = 0;
     ogs_ipsubnet_t dns_primary, dns_secondary, dns6_primary, dns6_secondary;
     ogs_ipsubnet_t p_cscf, p_cscf6;
@@ -2491,6 +2493,9 @@ int smf_pco_build(uint8_t *pco_buf, uint8_t *buffer, int length)
     ogs_assert(buffer);
     ogs_assert(length);
 
+    num_of_ipcp = 0;
+    memset(&pco_ipcp, 0, sizeof(pco_ipcp));
+
     size = ogs_pco_parse(&ue, buffer, length);
     ogs_assert(size);
 
@@ -2550,8 +2555,8 @@ int smf_pco_build(uint8_t *pco_buf, uint8_t *buffer, int length)
                 ogs_assert(ipcp);
                 in_len = be16toh(ipcp->len);
 
-                memset(&pco_ipcp, 0, sizeof(ogs_pco_ipcp_t));
-                pco_ipcp.code = 2; /* Code : Configuration Ack */
+                ogs_assert(num_of_ipcp <= OGS_PCO_MAX_NUM_OF_IPCP);
+                pco_ipcp[num_of_ipcp].code = 2; /* Code : Configuration Ack */
 
                 out_len = 4;
                 /* Primary DNS Server IP Address */
@@ -2561,10 +2566,13 @@ int smf_pco_build(uint8_t *pco_buf, uint8_t *buffer, int length)
                     rv = ogs_ipsubnet(
                             &dns_primary, smf_self()->dns[0], NULL);
                     ogs_assert(rv == OGS_OK);
-                    pco_ipcp.options[num_of_option].type =
+                    ogs_assert(
+                            num_of_option <= OGS_PCO_MAX_NUM_OF_IPCP_OPTIONS);
+                    pco_ipcp[num_of_ipcp].options[num_of_option].type =
                         OGS_IPCP_OPT_PRIMARY_DNS;
-                    pco_ipcp.options[num_of_option].len = 6;
-                    pco_ipcp.options[num_of_option].addr = dns_primary.sub[0];
+                    pco_ipcp[num_of_ipcp].options[num_of_option].len = 6;
+                    pco_ipcp[num_of_ipcp].options[num_of_option].addr =
+                        dns_primary.sub[0];
                     num_of_option++;
 
                     out_len += 6;
@@ -2577,20 +2585,25 @@ int smf_pco_build(uint8_t *pco_buf, uint8_t *buffer, int length)
                     rv = ogs_ipsubnet(
                             &dns_secondary, smf_self()->dns[1], NULL);
                     ogs_assert(rv == OGS_OK);
-                    pco_ipcp.options[num_of_option].type =
+                    ogs_assert(
+                            num_of_option <= OGS_PCO_MAX_NUM_OF_IPCP_OPTIONS);
+                    pco_ipcp[num_of_ipcp].options[num_of_option].type =
                         OGS_IPCP_OPT_SECONDARY_DNS;
-                    pco_ipcp.options[num_of_option].len = 6;
-                    pco_ipcp.options[num_of_option].addr = dns_secondary.sub[0];
+                    pco_ipcp[num_of_ipcp].options[num_of_option].len = 6;
+                    pco_ipcp[num_of_ipcp].options[num_of_option].addr =
+                        dns_secondary.sub[0];
                     num_of_option++;
 
                     out_len += 6;
                 }
 
-                pco_ipcp.len = htobe16(out_len);
+                pco_ipcp[num_of_ipcp].len = htobe16(out_len);
 
                 smf.ids[smf.num_of_id].id = ue.ids[i].id;
                 smf.ids[smf.num_of_id].len = out_len;
-                smf.ids[smf.num_of_id].data = (uint8_t *)&pco_ipcp;
+                smf.ids[smf.num_of_id].data = (uint8_t *)&pco_ipcp[num_of_ipcp];
+
+                num_of_ipcp++;
 
                 smf.num_of_id++;
             }
diff --git a/tests/common/esm-build.c b/tests/common/esm-build.c
index f96276d17..7ccd30541 100644
--- a/tests/common/esm-build.c
+++ b/tests/common/esm-build.c
@@ -152,11 +152,16 @@ ogs_pkbuf_t *testesm_build_esm_information_response(test_sess_t *sess)
         "\x6a\x43\x6b\x2f\x0f\x9f\x82\x35\x6e\x07\xd9\xd9\x80\x21\x1c\x01"
         "\x00\x00\x1c\x81\x06\x00\x00\x00\x00\x82\x06\x00\x00\x00\x00\x83"
         "\x06\x00\x00\x00\x00\x84\x06\x00\x00\x00\x00";
-#endif
     uint8_t ue_pco[35] =
         "\x80\x80\x21\x10\x01\x00\x00\x10\x81\x06\x00\x00\x00\x00"
         "\x83\x06\x00\x00\x00\x00\x00\x0c\x00\x00\x0d\x00\x00\x02\x00\x00"
         "\x0a\x00\x00\x10\x00";
+#endif
+    uint8_t ue_pco[47] =
+        "\x80\x80\x21\x0a\x01\x0a"
+        "\x00\x0a\x81\x06\x00\x00\x00\x00\x80\x21\x0a\x01\x0b\x00\x0a\x83"
+        "\x06\x00\x00\x00\x00\xc0\x23\x11\x01\x0c\x00\x11\x03\x72\x69\x6d"
+        "\x08\x70\x61\x73\x73\x77\x6f\x72\x64";
 
     test_ue_t *test_ue = NULL;
     ogs_pkbuf_t *pkbuf = NULL;