diff --git a/src/core/dhcp/nm-dhcp-nettools.c b/src/core/dhcp/nm-dhcp-nettools.c
index ee755c4b3..f13798331 100644
--- a/src/core/dhcp/nm-dhcp-nettools.c
+++ b/src/core/dhcp/nm-dhcp-nettools.c
@@ -690,7 +690,7 @@ lease_to_ip4_config(NMDedupMultiIndex *multi_idx,
     if (r == 0 && nm_dhcp_lease_data_parse_cstr(l_data, l_data_len, &l_data_len)) {
         /* https://tools.ietf.org/html/draft-ietf-wrec-wpad-01#section-4.4.1
          *
-         * We reject NUL characters inside the string (except one trailing NUL).
+         * We reject NUL characters inside the string (except trailing NULs).
          * Otherwise, we allow any encoding and backslash-escape the result to
          * UTF-8. */
         nm_dhcp_option_add_option_utf8safe_escape(options,
diff --git a/src/core/dhcp/nm-dhcp-utils.c b/src/core/dhcp/nm-dhcp-utils.c
index 0ae0dcb96..646411e20 100644
--- a/src/core/dhcp/nm-dhcp-utils.c
+++ b/src/core/dhcp/nm-dhcp-utils.c
@@ -873,20 +873,20 @@ gboolean
 nm_dhcp_lease_data_parse_cstr(const guint8 *data, gsize n_data, gsize *out_new_len)
 {
     /* WARNING: this function only validates that the string does not contain
-     * NUL characters (and ignores one trailing NUL). It does not check character
+     * NUL characters (and ignores trailing NULs). It does not check character
      * encoding! */
 
+    while (n_data > 0 && data[n_data - 1] == '\0')
+        n_data--;
+
     if (n_data > 0) {
-        if (memchr(data, n_data - 1, '\0')) {
-            /* we accept one trailing NUL (not more).
+        if (memchr(data, n_data, '\0')) {
+            /* we accept trailing NUL, but none in between.
              *
              * https://tools.ietf.org/html/rfc2132#section-2
              * https://github.com/systemd/systemd/issues/1337 */
             return FALSE;
         }
-
-        if (data[n_data - 1] == '\0')
-            n_data--;
     }
 
     NM_SET_OUT(out_new_len, n_data);
@@ -937,7 +937,7 @@ nm_dhcp_lease_data_parse_domain(const guint8 *data, gsize n_data, char **out_val
          *
          *   Its minimum length is 1.
          *
-         * Note that this is *after* we potentially stripped a trailing NUL.
+         * Note that this is *after* we potentially stripped trailing NULs.
          */
         return FALSE;
     }