diff --git a/fs/skeleton/bin/apman b/fs/skeleton/bin/apman
index 8780a94..94d7778 100755
--- a/fs/skeleton/bin/apman
+++ b/fs/skeleton/bin/apman
@@ -28,34 +28,30 @@
   ip "$@"
 }
 
-# extension is either "interface_suffix.band" or just "band"
-stopap() {
-  local extension="$1"
+valid_word() {
+  case "$1" in
+    access_point|command) return 0 ;;
+    *) return 1 ;;
+  esac
+}
 
-  bands="2.4 5"
-  for band in $bands; do
-    if [ "$extension" = "$band" ]; then
-      break
-    else
-      if endswith "$extension" "$band"; then
-        interface_suffix=${extension%.$band}
-        break
-      else
-        interface_suffix=
-        band=
-      fi
-    fi
-  done
-  if [ -z "$band" ]; then
-    echo "Failed to parse extension '$extension'"
-    return
-  fi
+valid_band() {
+  case "$1" in
+    2.4|5) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+stopap() {
+  local interface_suffix="$1"
+  local band="$2"
+
   flags="--band $band"
   if [ -n "$interface_suffix" ]; then
     flags="$flags --interface-suffix "$interface_suffix""
   fi
   if ! $(wifi stopap $flags); then
-    echo "Failed to stop access point for '$extension'"
+    echo "Failed to stop access point for $suffix $band"
     false
   fi
 }
@@ -77,6 +73,12 @@
     filepath="$TMP_DIR/$filename"
     if [ -e "$filepath" ]; then
       interface=${filename#${route_type}.}
+
+      # make sure interface is actually an interface, and not a .tmp file
+      if [ ! -e "/sys/class/net/$interface" ]; then
+        continue
+      fi
+
       # Trying to add a default route without a subnet route fails, because
       # there is no route to the gateway.  So just always update the subnet
       # route first, and then update the default route if we know the gateway.
@@ -118,28 +120,34 @@
     continue
   fi
 
-  command=
-  access_point=
   # This assumes command files in /tmp (for provisioning networks) will have an
-  # interface suffix, and those in /config (the user's WLAN) will not.  Or, more
-  # generally, that for any given filename, files of that filename can only
-  # appear in one of ($TMP_DIR, $CONFIG_DIR).
-  if [ -e "$CONFIG_DIR/$filename" ]; then
-    which_dir="$CONFIG_DIR"
+  # interface suffix, and those in /config (the user's WLAN) will not.
+  word=
+  suffix=
+  band=
+
+  IFS='.' read word band <<EOF
+$filename
+EOF
+  if valid_word "$word" && valid_band "$band"; then
+    expect_dir="$CONFIG_DIR"
   else
-    which_dir="$TMP_DIR"
+    IFS='.' read word suffix band <<EOF
+$filename
+EOF
+    if valid_word "$word" && valid_band "$band"; then
+      expect_dir="$TMP_DIR"
+    else
+      continue
+    fi
   fi
 
-  if startswith "$filename" "command."; then
-    extension=${filename#command.}
-    command="$which_dir/$filename"
-    access_point="$which_dir/access_point.$extension"
+  if [ -z "$suffix" ]; then
+    command="$expect_dir/command.$band"
+    access_point="$expect_dir/access_point.$band"
   else
-    if startswith "$filename" "access_point."; then
-      extension=${filename#access_point.}
-      command="$which_dir/command.$extension"
-      access_point="$which_dir/$filename"
-    fi
+    command="$expect_dir/command.$suffix.$band"
+    access_point="$expect_dir/access_point.$suffix.$band"
   fi
 
   if [ -e "$command" ] && [ -e "$access_point" ]; then
@@ -147,6 +155,6 @@
       echo "Failed to start access point for '$extension'"
     fi
   else
-    stopap "$extension"
+    stopap "$suffix" "$band"
   fi
 done
diff --git a/fs/skeleton/bin/apman.test b/fs/skeleton/bin/apman.test
index 8e27b4c..a888b73 100755
--- a/fs/skeleton/bin/apman.test
+++ b/fs/skeleton/bin/apman.test
@@ -81,6 +81,8 @@
 pkill "apman$"
 rm -f /config/conman/command*
 rm -f /config/conman/access_point*
+rm -f /tmp/conman/command*
+rm -f /tmp/conman/access_point*
 # Creating wlan0_apmantest sometimes fails if we don't reset wlan0.
 wlan0mac=$(cat /sys/class/net/wlan0/address)
 mac=$(mac_addr_increment $wlan0mac 100)
@@ -101,30 +103,51 @@
 WVFAIL hostapd_running
 
 echo "Enable 5 GHz access point"
+echo "env\nWIFI_PSK=password\nwifi\nset\n-b\n5\n-s\nssid" > /tmp/conman/command.5
+echo "Waiting to make sure hostapd doesn't start (wrong location)"
+hostapd_wait_check_running false
+
+echo "Enable 5 GHz access point"
 echo "env\nWIFI_PSK=password\nwifi\nset\n-b\n5\n-s\nssid" > /config/conman/command.5
 hostapd_wait_check_running true
 
 echo "Disable 5 GHz access point"
 rm /config/conman/access_point.5
+touch /tmp/conman/access_point.5
 hostapd_wait_check_running false
 
-touch /config/conman/access_point._apmantest.2.4
+touch /tmp/conman/access_point._apmantest.2.4
 echo "Waiting to make sure hostapd doesn't start"
 hostapd_wait_check_running false
 
 echo "env\nWIFI_PSK=password\nwifi\nset\n-b\n2.4\n-s\nssid" > /config/conman/command.2.4
-echo "Waiting to make sure hostapd doesn't start"
+echo "Waiting to make sure hostapd doesn't start (wrong suffix)"
 hostapd_wait_check_running false
 
-echo "env\nWIFI_PSK=password\nwifi\nset\n-b\n2.4\n-s\nssid\n-S\n_apmantest" > /config/conman/command._apmantest.2.4
+echo "env\nWIFI_PSK=password\nwifi\nset\n-b\n2.4\n-s\nssid" > /config/conman/command._apmantest.2.4
+echo "Waiting to make sure hostapd doesn't start (wrong location)"
+hostapd_wait_check_running false
+
+echo "env\nWIFI_PSK=password\nwifi\nset\n-b\n2.4\n-s\nssid\n-S\n_apmantest" > /tmp/conman/command._apmantest.2.4
 hostapd_wait_check_running true
 
+rm /tmp/conman/access_point._apmantest.2.4
+touch /config/conman/access_point._apmantest.2.4
+echo "Waiting to make sure hostapd doesn't start (wrong location)"
+hostapd_wait_check_running false
+
 WVSTART "route management"
 echo "192.168.1.1" > /tmp/conman/gateway.wlan0_apmantest
 echo "192.168.1.0/24" > /tmp/conman/subnet.wlan0_apmantest
 WVPASS wait_route_changed "add" "default via 192.168.1.1" "wlan0_apmantest"
 WVPASS wait_route_changed "add" "192.168.1.0/24" "wlan0_apmantest"
 
+# Make sure non-interfaces are ignored.
+echo "192.168.2.1" > /tmp/conman/gateway.wlan0_apmantest.tmp
+echo "192.168.2.0/16" > /tmp/conman/subnet.wlan0_apmantest.tmp
+echo "192.168.3.1" > /tmp/conman/gateway.wlan0_apmantest_tmp
+echo "192.168.3.0/16" > /tmp/conman/subnet.wlan0_apmantest_tmp
+
 echo "default via 192.168.1.1 dev wlan0_apmantest" > $tmpdir/ip_route_show
 echo "192.168.1.0/24 dev wlan0_apmantest" >> $tmpdir/ip_route_show
 
@@ -134,6 +157,9 @@
 WVPASS wait_route_changed "del" "192.168.1.0/24" "wlan0_apmantest"
 WVPASS wait_route_changed "add" "192.168.1.0/16" "wlan0_apmantest"
 
+WVPASS grep "192\.168\.1\." "$ip_out"
+WVFAIL grep "192\.168\.2\." "$ip_out"
+WVFAIL grep "192\.168\.3\." "$ip_out"
 
 echo "Cleaning up"
 WVPASS iw dev wlan0_apmantest del
@@ -141,5 +167,7 @@
 wifi off
 rm -f /config/conman/command*
 rm -f /config/conman/access_point*
+rm -f /tmp/conman/command*
+rm -f /tmp/conman/access_point*
 rm -f /tmp/conman/gateway.br0
 rm -rf $tmpdir