3 files changed, 12 insertions, 6 deletions

diff --git a/src/core/hle/ipc_helpers.h b/src/core/hle/ipc_helpers.h
index 6066d8a18..3f87c4297 100644
--- a/src/core/hle/ipc_helpers.h
+++ b/src/core/hle/ipc_helpers.h
@@ -118,7 +118,8 @@ public:
 
         AlignWithPadding();
 
-        if (context.Session()->IsDomain()) {
+        const bool request_has_domain_header{context.GetDomainMessageHeader() != nullptr};
+        if (context.Session()->IsDomain() && request_has_domain_header) {
             IPC::DomainMessageHeader domain_header{};
             domain_header.num_objects = num_domain_objects;
             PushRaw(domain_header);
diff --git a/src/core/hle/kernel/hle_ipc.cpp b/src/core/hle/kernel/hle_ipc.cpp
index 25ba26f18..d9faf4b53 100644
--- a/src/core/hle/kernel/hle_ipc.cpp
+++ b/src/core/hle/kernel/hle_ipc.cpp
@@ -85,9 +85,14 @@ void HLERequestContext::ParseCommandBuffer(u32_le* src_cmdbuf, bool incoming) {
 
     if (Session()->IsDomain() && (command_header->type == IPC::CommandType::Request || !incoming)) {
         // If this is an incoming message, only CommandType "Request" has a domain header
-        // All outgoing domain messages have the domain header
-        domain_message_header =
-            std::make_unique<IPC::DomainMessageHeader>(rp.PopRaw<IPC::DomainMessageHeader>());
+        // All outgoing domain messages have the domain header, if only incoming has it
+        if (incoming || domain_message_header) {
+            domain_message_header =
+                std::make_unique<IPC::DomainMessageHeader>(rp.PopRaw<IPC::DomainMessageHeader>());
+        } else {
+            if (Session()->IsDomain())
+                LOG_WARNING(IPC, "Domain request has no DomainMessageHeader!");
+        }
     }
 
     data_payload_header =
@@ -196,7 +201,7 @@ ResultCode HLERequestContext::WriteToOutgoingCommandBuffer(u32_le* dst_cmdbuf, P
 
     // TODO(Subv): Translate the X/A/B/W buffers.
 
-    if (Session()->IsDomain()) {
+    if (Session()->IsDomain() && domain_message_header) {
         ASSERT(domain_message_header->num_objects == domain_objects.size());
         // Write the domain objects to the command buffer, these go after the raw untranslated data.
         // TODO(Subv): This completely ignores C buffers.
diff --git a/src/core/hle/kernel/server_session.cpp b/src/core/hle/kernel/server_session.cpp
index 5608418c3..5f31cf19b 100644
--- a/src/core/hle/kernel/server_session.cpp
+++ b/src/core/hle/kernel/server_session.cpp
@@ -96,7 +96,7 @@ ResultCode ServerSession::HandleSyncRequest(SharedPtr<Thread> thread) {
 
     ResultCode result = RESULT_SUCCESS;
     // If the session has been converted to a domain, handle the domain request
-    if (IsDomain()) {
+    if (IsDomain() && context.GetDomainMessageHeader()) {
         result = HandleDomainSyncRequest(context);
         // If there is no domain header, the regular session handler is used
     } else if (hle_handler != nullptr) {