PUD: check type after length in downlink path