diff --git a/.claude/skills/feature-review/references/conventions.md b/.claude/skills/feature-review/references/conventions.md
index 0715193403..fdfb50a29a 100644
--- a/.claude/skills/feature-review/references/conventions.md
+++ b/.claude/skills/feature-review/references/conventions.md
@@ -84,7 +84,19 @@ Reference: `HostsFileEditorView.xaml`, `FirewallView.xaml`.
   `SelectedResults` is changed in place (no change notification): selection-dependent properties are raised
   in `OnContextMenuOpened()` called from the view's `ContextMenu_Opened`.
 - Two context menus: `RowContextMenu` (one row) and `MultiRowContextMenu` (several rows), switched by a
-  `DataTrigger` on `SelectedItems.Count`. `Opened="ContextMenu_Opened"` sets the menu's `DataContext`.
+  `DataTrigger` on `SelectedItems.Count`.
+- A context menu is not part of the visual tree and doesn't inherit the `DataContext`: the menu gets
+  `DataContext="{Binding Data, Source={StaticResource BindingProxy}}"` in XAML, with
+  `<wpfHelpers:BindingProxy x:Key="BindingProxy" Data="{Binding}" />` in the view's own resources, declared before
+  the menus. The bindings inside the menu are plain bindings (`{Binding EditEntryCommand}`). Don't set the
+  `DataContext` in `ContextMenu_Opened` (until the menu is opened, its bindings fail and are logged as XAML binding
+  errors). `Opened` is only for extra work, e.g. `OnContextMenuOpened()` or the custom commands of the IP Scanner.
+- No bindings that have no element to resolve against: no `VisualBrush` / `BitmapImage` with a binding in a style
+  setter or as a freezable resource. Bind the property of the element with a converter instead
+  (`VisualToVisualBrushConverter`, `ApplicationNameToIconBrushConverter`, `Image Source="{Binding Uri}"`). A static
+  `VisualBrush` (`Visual="{iconPacks:Material Kind=...}"`) is fine. `MenuItem`s created outside a menu (e.g. extra
+  items in an `x:Array`) are fine: the implicit `DefaultMenuItem` style sets the content alignment directly instead
+  of the MahApps binding to the parent. New `MenuItem` styles are `BasedOn="{StaticResource DefaultMenuItem}"`.
 - Order: Enable / Disable (only the applicable one) → Edit... → Copy as... → Delete → separator → Copy
   (submenu, `CopyMenuItem` style) → Export...
 - Icons (16×16 `Rectangle`, `MahApps.Brushes.Gray3`, `VisualBrush`): Enable `Material ToggleSwitchOutline`,
diff --git a/Source/NETworkManager.Converters/ProfileToPortScannerPortsConverter.cs b/Source/NETworkManager.Converters/ProfileToPortScannerPortsConverter.cs
new file mode 100644
index 0000000000..b89fde8830
--- /dev/null
+++ b/Source/NETworkManager.Converters/ProfileToPortScannerPortsConverter.cs
@@ -0,0 +1,42 @@
+using System;
+using System.Globalization;
+using System.Windows.Data;
+using NETworkManager.Profiles;
+
+namespace NETworkManager.Converters;
+
+/// <summary>
+///     Convert a <see cref="ProfileInfo" /> to the ports the Port Scanner scans for it (own ports, otherwise the ports
+///     of its group, port profiles with their current name).
+/// </summary>
+public sealed class ProfileToPortScannerPortsConverter : IValueConverter
+{
+    /// <summary>
+    ///     Convert a <see cref="ProfileInfo" /> to the ports to scan (see
+    ///     <see cref="Profiles.Application.PortScanner.GetPorts" />).
+    /// </summary>
+    /// <param name="value">Object from type <see cref="ProfileInfo" />.</param>
+    /// <param name="targetType"></param>
+    /// <param name="parameter"></param>
+    /// <param name="culture"></param>
+    /// <returns>Ports to scan, empty if neither the profile nor its group has ports.</returns>
+    public object Convert(object value, Type targetType, object parameter, CultureInfo culture)
+    {
+        return value is not ProfileInfo profile
+            ? string.Empty
+            : Profiles.Application.PortScanner.GetPorts(profile, out _);
+    }
+
+    /// <summary>
+    ///     !!! Method not implemented !!!
+    /// </summary>
+    /// <param name="value"></param>
+    /// <param name="targetType"></param>
+    /// <param name="parameter"></param>
+    /// <param name="culture"></param>
+    /// <returns></returns>
+    public object ConvertBack(object value, Type targetType, object parameter, CultureInfo culture)
+    {
+        throw new NotImplementedException();
+    }
+}
diff --git a/Source/NETworkManager.Models/Network/IPScanner.cs b/Source/NETworkManager.Models/Network/IPScanner.cs
index f62f11742b..88053c2601 100644
--- a/Source/NETworkManager.Models/Network/IPScanner.cs
+++ b/Source/NETworkManager.Models/Network/IPScanner.cs
@@ -28,6 +28,9 @@ public sealed class IPScanner(IPScannerOptions options)
     /// </summary>
     private static readonly TimeSpan MaxHostStartInterval = TimeSpan.FromMilliseconds(10);
 
+    // Data sent with the ping, created once (see IPScannerOptions.ICMPBufferSize)
+    private readonly byte[] _icmpBuffer = new byte[options.ICMPBufferSize];
+
     private int _progressValue;
     private readonly InterlockedCounter _hostsUp = new();
     private readonly InterlockedCounter _hostsDown = new();
@@ -211,7 +214,7 @@ private async Task ScanHostAsync(IPAddress ipAddress, ParallelOptions portScanPa
         var portAnswered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
 
         var pingTask = PingProbe.PingAsync(ipAddress, options.ICMPTimeout, options.ICMPAttempts,
-            options.ICMPBuffer, cancellationToken);
+            _icmpBuffer, cancellationToken);
 
         var portScanTask = options.PortScanEnabled
             ? PortScanAsync(ipAddress, portScanParallelOptions, () => portAnswered.TrySetResult(), cancellationToken)
diff --git a/Source/NETworkManager.Models/Network/IPScannerOptions.cs b/Source/NETworkManager.Models/Network/IPScannerOptions.cs
index 54e08dba1a..39047590e9 100644
--- a/Source/NETworkManager.Models/Network/IPScannerOptions.cs
+++ b/Source/NETworkManager.Models/Network/IPScannerOptions.cs
@@ -27,9 +27,10 @@ public record IPScannerOptions
     public required int ICMPTimeout { get; init; }
 
     /// <summary>
-    ///     Size of the buffer used in the ping in bytes.
+    ///     Size of the buffer used in the ping in bytes. A size, not the buffer, so options with the same values are
+    ///     equal (records compare arrays by reference).
     /// </summary>
-    public required byte[] ICMPBuffer { get; init; }
+    public required int ICMPBufferSize { get; init; }
 
     /// <summary>
     ///     Resolve the hostname for an IP address.
diff --git a/Source/NETworkManager.Models/Network/Ping.cs b/Source/NETworkManager.Models/Network/Ping.cs
index fc06a056d2..fc64412f19 100644
--- a/Source/NETworkManager.Models/Network/Ping.cs
+++ b/Source/NETworkManager.Models/Network/Ping.cs
@@ -1,7 +1,6 @@
 using System;
 using System.Net;
 using System.Net.NetworkInformation;
-using System.Net.Sockets;
 using System.Threading;
 using System.Threading.Tasks;
 using NETworkManager.Utilities;
@@ -26,9 +25,9 @@ public sealed class Ping
     public int Timeout = 4000;
 
     /// <summary>
-    ///     The buffer to send with the ping request. Default is 32 bytes.
+    ///     The size in bytes of the buffer to send with the ping request. Default is 32 bytes.
     /// </summary>
-    public byte[] Buffer = new byte[32];
+    public int BufferSize = 32;
 
     /// <summary>
     ///     The Time to Live (TTL) value for the ping request. Default is 64.
@@ -123,6 +122,8 @@ public void SendAsync(IPAddress ipAddress, CancellationToken cancellationToken)
 
             var errorCount = 0;
 
+            var buffer = new byte[BufferSize];
+
             var options = new PingOptions
             {
                 Ttl = TTL,
@@ -139,7 +140,7 @@ public void SendAsync(IPAddress ipAddress, CancellationToken cancellationToken)
                         var timestamp = DateTime.Now;
 
                         // Send ping
-                        var pingReply = ping.Send(ipAddress, Timeout, Buffer, options);
+                        var pingReply = ping.Send(ipAddress, Timeout, buffer, options);
 
                         // Reset the error count (if no exception was thrown)
                         errorCount = 0;
@@ -152,15 +153,8 @@ public void SendAsync(IPAddress ipAddress, CancellationToken cancellationToken)
                         }
                         else
                         {
-                            if (ipAddress.AddressFamily == AddressFamily.InterNetwork)
-                                OnPingReceived(new PingReceivedArgs(
-                                    new PingInfo(timestamp, pingReply.Address, hostname,
-                                        pingReply.Buffer.Length, pingReply.RoundtripTime, pingReply.Options!.Ttl,
-                                        pingReply.Status)));
-                            else
-                                OnPingReceived(new PingReceivedArgs(
-                                    new PingInfo(timestamp, pingReply.Address, hostname,
-                                        pingReply.Buffer.Length, pingReply.RoundtripTime, pingReply.Status)));
+                            OnPingReceived(new PingReceivedArgs(
+                                PingInfo.FromSuccessfulReply(timestamp, pingReply, hostname)));
                         }
                     }
                     catch (PingException ex)
diff --git a/Source/NETworkManager.Models/Network/PingInfo.cs b/Source/NETworkManager.Models/Network/PingInfo.cs
index 4a15bf88cb..e3c5c5bcfc 100644
--- a/Source/NETworkManager.Models/Network/PingInfo.cs
+++ b/Source/NETworkManager.Models/Network/PingInfo.cs
@@ -122,6 +122,22 @@ public PingInfo(DateTime timestamp, IPAddress ipAddress, string hostname, int by
         Status = status;
     }
 
+    /// <summary>
+    ///     Creates a <see cref="PingInfo" /> from a successful ping reply. The TTL is only available for IPv4.
+    /// </summary>
+    /// <param name="timestamp">Timestamp when the ping was sent.</param>
+    /// <param name="pingReply">Successful reply of the ping.</param>
+    /// <param name="hostname">Hostname of the host.</param>
+    /// <returns>Information of the ping.</returns>
+    internal static PingInfo FromSuccessfulReply(DateTime timestamp, PingReply pingReply, string hostname = null)
+    {
+        return pingReply.Address.AddressFamily == AddressFamily.InterNetwork
+            ? new PingInfo(timestamp, pingReply.Address, hostname, pingReply.Buffer.Length, pingReply.RoundtripTime,
+                pingReply.Options!.Ttl, pingReply.Status)
+            : new PingInfo(timestamp, pingReply.Address, hostname, pingReply.Buffer.Length, pingReply.RoundtripTime,
+                pingReply.Status);
+    }
+
     /// <summary>
     ///     Timestamp when the ping was sent.
     /// </summary>
diff --git a/Source/NETworkManager.Models/Network/PingProbe.cs b/Source/NETworkManager.Models/Network/PingProbe.cs
index b5dff7a4cc..cc109803bf 100644
--- a/Source/NETworkManager.Models/Network/PingProbe.cs
+++ b/Source/NETworkManager.Models/Network/PingProbe.cs
@@ -1,7 +1,6 @@
 using System;
 using System.Net;
 using System.Net.NetworkInformation;
-using System.Net.Sockets;
 using System.Threading;
 using System.Threading.Tasks;
 
@@ -43,26 +42,7 @@ public static async Task<PingInfo> PingAsync(IPAddress ipAddress, int timeoutMs,
 
                 // Success
                 if (pingReply is { Status: IPStatus.Success })
-                {
-                    switch (ipAddress.AddressFamily)
-                    {
-                        case AddressFamily.InterNetwork:
-                            return new PingInfo(
-                                timestamp,
-                                pingReply.Address,
-                                pingReply.Buffer.Length,
-                                pingReply.RoundtripTime,
-                                pingReply.Options!.Ttl,
-                                pingReply.Status);
-                        case AddressFamily.InterNetworkV6:
-                            return new PingInfo(
-                                timestamp,
-                                pingReply.Address,
-                                pingReply.Buffer.Length,
-                                pingReply.RoundtripTime,
-                                pingReply.Status);
-                    }
-                }
+                    return PingInfo.FromSuccessfulReply(timestamp, pingReply);
 
                 // Failed
                 pingInfo = new PingInfo(timestamp, ipAddress, pingReply.Status);
diff --git a/Source/NETworkManager.Models/Network/PortScanner.cs b/Source/NETworkManager.Models/Network/PortScanner.cs
index 72be0ce9a0..370ac31b5e 100644
--- a/Source/NETworkManager.Models/Network/PortScanner.cs
+++ b/Source/NETworkManager.Models/Network/PortScanner.cs
@@ -19,6 +19,7 @@ public sealed class PortScanner
     public PortScanner(PortScannerOptions options)
     {
         _options = options;
+        _icmpBuffer = new byte[options.ICMPBufferSize];
     }
 
     #endregion
@@ -69,6 +70,9 @@ public PortScanner(PortScannerOptions options)
 
     private readonly PortScannerOptions _options;
 
+    // Data sent with the ping before the scan, created once (see PortScannerOptions.ICMPBufferSize)
+    private readonly byte[] _icmpBuffer;
+
     /// <summary>
     ///     Gets the number of ports scanned so far. Thread-safe; may be read from any thread while the scan is
     ///     running.
@@ -394,7 +398,7 @@ await Parallel.ForEachAsync(hosts, pingParallelOptions, async (host, ct) =>
     private async Task<bool> IsReachableAsync(IPAddress ipAddress, int portCount, CancellationToken cancellationToken)
     {
         var pingInfo = await PingProbe.PingAsync(ipAddress, _options.ICMPTimeout, _options.ICMPAttempts,
-            _options.ICMPBuffer, cancellationToken).ConfigureAwait(false);
+            _icmpBuffer, cancellationToken).ConfigureAwait(false);
 
         if (pingInfo.Status == IPStatus.Success)
             return true;
diff --git a/Source/NETworkManager.Models/Network/PortScannerOptions.cs b/Source/NETworkManager.Models/Network/PortScannerOptions.cs
index 961e868fdb..ce447114d9 100644
--- a/Source/NETworkManager.Models/Network/PortScannerOptions.cs
+++ b/Source/NETworkManager.Models/Network/PortScannerOptions.cs
@@ -33,7 +33,7 @@ public record PortScannerOptions
 
     /// <summary>
     ///     Ping every host before its ports are scanned (with <see cref="ICMPAttempts" />, <see cref="ICMPTimeout" /> and
-    ///     <see cref="ICMPBuffer" />), a host that doesn't answer is not scanned.
+    ///     <see cref="ICMPBufferSize" />), a host that doesn't answer is not scanned.
     /// </summary>
     public required bool PingHostsBeforeScan { get; init; }
 
@@ -49,9 +49,10 @@ public record PortScannerOptions
     public required int ICMPTimeout { get; init; }
 
     /// <summary>
-    ///     Data sent with the ping before the scan (see <see cref="PingHostsBeforeScan" />).
+    ///     Size in bytes of the data sent with the ping before the scan (see <see cref="PingHostsBeforeScan" />). A size,
+    ///     not the buffer, so options with the same values are equal (records compare arrays by reference).
     /// </summary>
-    public required byte[] ICMPBuffer { get; init; }
+    public required int ICMPBufferSize { get; init; }
 
     /// <summary>
     ///     Resolve the hostname for an IP address.
diff --git a/Source/NETworkManager.Models/Network/Traceroute.cs b/Source/NETworkManager.Models/Network/Traceroute.cs
index 0115c98963..d0f6337622 100644
--- a/Source/NETworkManager.Models/Network/Traceroute.cs
+++ b/Source/NETworkManager.Models/Network/Traceroute.cs
@@ -17,6 +17,9 @@ public sealed class Traceroute
 
     private readonly TracerouteOptions _options;
 
+    // Data sent with the ping, created once (see TracerouteOptions.BufferSize)
+    private readonly byte[] _buffer;
+
     #endregion
 
     #region Constructor
@@ -24,6 +27,7 @@ public sealed class Traceroute
     public Traceroute(TracerouteOptions options)
     {
         _options = options;
+        _buffer = new byte[options.BufferSize];
     }
 
     #endregion
@@ -55,7 +59,7 @@ public void TraceAsync(IPAddress ipAddress, CancellationToken cancellationToken)
                             {
                                 stopwatch.Start();
 
-                                pingReply = ping.Send(ipAddress, _options.Timeout, _options.Buffer,
+                                pingReply = ping.Send(ipAddress, _options.Timeout, _buffer,
                                     new PingOptions { Ttl = i1, DontFragment = _options.DontFragment });
 
                                 stopwatch.Stop();
diff --git a/Source/NETworkManager.Models/Network/TracerouteOptions.cs b/Source/NETworkManager.Models/Network/TracerouteOptions.cs
index 2233fb378f..1cbaf5e941 100644
--- a/Source/NETworkManager.Models/Network/TracerouteOptions.cs
+++ b/Source/NETworkManager.Models/Network/TracerouteOptions.cs
@@ -9,16 +9,16 @@ public class TracerouteOptions
     ///     Create an instance of <see cref="TracerouteOptions" /> with parameters.
     /// </summary>
     /// <param name="timeout">Timeout in milliseconds after which a ping is considered lost.</param>
-    /// <param name="buffer">Size of the buffer used in the ping in bytes.</param>
+    /// <param name="bufferSize">Size of the buffer used in the ping in bytes.</param>
     /// <param name="maximumHops">Maximum number of hops between the local and remote computer.</param>
     /// <param name="dontFragment">Do not fragment the ping packet.</param>
     /// <param name="resolveHostname">Resolve the hostname for an IP address.</param>
     /// <param name="checkIPApiIPGeolocation">Check IP geolocation via ip-api.com.</param>
-    public TracerouteOptions(int timeout, byte[] buffer, int maximumHops, bool dontFragment, bool resolveHostname,
+    public TracerouteOptions(int timeout, int bufferSize, int maximumHops, bool dontFragment, bool resolveHostname,
         bool checkIPApiIPGeolocation)
     {
         Timeout = timeout;
-        Buffer = buffer;
+        BufferSize = bufferSize;
         MaximumHops = maximumHops;
         DontFragment = dontFragment;
         ResolveHostname = resolveHostname;
@@ -33,7 +33,7 @@ public TracerouteOptions(int timeout, byte[] buffer, int maximumHops, bool dontF
     /// <summary>
     ///     Size of the buffer used in the ping in bytes.
     /// </summary>
-    public byte[] Buffer { get; }
+    public int BufferSize { get; }
 
     /// <summary>
     ///     Maximum number of hops between the local and remote computer.
diff --git a/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs b/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs
index d3ea08f0bf..48ad2b3032 100644
--- a/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs
+++ b/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs
@@ -46,6 +46,14 @@ public static class GlobalStaticConfiguration
     // ICMP config: maximum buffer of a ping (.NET's Ping throws for more than 65500 bytes)
     public static int ICMPBufferMaximum => 65500;
 
+    /// <summary>
+    ///     Limits the buffer size of a ping from the settings to the limits of the input (1 to
+    ///     <see cref="ICMPBufferMaximum" />). A value edited in the settings file would throw or make every ping fail.
+    /// </summary>
+    /// <param name="size">Buffer size in bytes from the settings.</param>
+    /// <returns>Buffer size in bytes within the limits.</returns>
+    public static int LimitICMPBuffer(int size) => Math.Clamp(size, 1, ICMPBufferMaximum);
+
     // Profile config
     public static bool Profile_TagsMatchAny => true;
     public static bool Profile_ExpandProfileView => true;
diff --git a/Source/NETworkManager/ViewModels/IPScannerViewModel.cs b/Source/NETworkManager/ViewModels/IPScannerViewModel.cs
index c390d379af..4b92b976ab 100644
--- a/Source/NETworkManager/ViewModels/IPScannerViewModel.cs
+++ b/Source/NETworkManager/ViewModels/IPScannerViewModel.cs
@@ -901,9 +901,7 @@ private static IPScannerOptions CreateScanOptions(int[] ports)
             MaxPortThreads = SettingsManager.Current.IPScanner_MaxPortThreads,
             ICMPAttempts = SettingsManager.Current.IPScanner_ICMPAttempts,
             ICMPTimeout = SettingsManager.Current.IPScanner_ICMPTimeout,
-            // Limits of the input (a value edited in the settings file would throw or make every ping fail)
-            ICMPBuffer = new byte[Math.Clamp(SettingsManager.Current.IPScanner_ICMPBuffer, 1,
-                GlobalStaticConfiguration.ICMPBufferMaximum)],
+            ICMPBufferSize = GlobalStaticConfiguration.LimitICMPBuffer(SettingsManager.Current.IPScanner_ICMPBuffer),
             ResolveHostname = SettingsManager.Current.IPScanner_ResolveHostname,
             PortScanEnabled = SettingsManager.Current.IPScanner_PortScanEnabled,
             PortScanPorts = ports,
diff --git a/Source/NETworkManager/ViewModels/PingMonitorViewModel.cs b/Source/NETworkManager/ViewModels/PingMonitorViewModel.cs
index 1a91956a2b..15104c8bcc 100644
--- a/Source/NETworkManager/ViewModels/PingMonitorViewModel.cs
+++ b/Source/NETworkManager/ViewModels/PingMonitorViewModel.cs
@@ -571,9 +571,7 @@ public void Start()
         var ping = new Ping
         {
             Timeout = SettingsManager.Current.PingMonitor_Timeout,
-            // Limits of the input (a value edited in the settings file would throw or make every ping fail)
-            Buffer = new byte[Math.Clamp(SettingsManager.Current.PingMonitor_Buffer, 1,
-                GlobalStaticConfiguration.ICMPBufferMaximum)],
+            BufferSize = GlobalStaticConfiguration.LimitICMPBuffer(SettingsManager.Current.PingMonitor_Buffer),
             TTL = SettingsManager.Current.PingMonitor_TTL,
             DontFragment = SettingsManager.Current.PingMonitor_DontFragment,
             WaitTime = SettingsManager.Current.PingMonitor_WaitTime
diff --git a/Source/NETworkManager/ViewModels/PortScannerViewModel.cs b/Source/NETworkManager/ViewModels/PortScannerViewModel.cs
index 37c0164617..1c2811f163 100644
--- a/Source/NETworkManager/ViewModels/PortScannerViewModel.cs
+++ b/Source/NETworkManager/ViewModels/PortScannerViewModel.cs
@@ -1286,9 +1286,7 @@ private static PortScannerOptions CreateScanOptions()
             PingHostsBeforeScan = SettingsManager.Current.PortScanner_PingHostsBeforeScan,
             ICMPAttempts = SettingsManager.Current.PortScanner_ICMPAttempts,
             ICMPTimeout = SettingsManager.Current.PortScanner_ICMPTimeout,
-            // Limits of the input (a value edited in the settings file would throw or make every ping fail)
-            ICMPBuffer = new byte[Math.Clamp(SettingsManager.Current.PortScanner_ICMPBuffer, 1,
-                GlobalStaticConfiguration.ICMPBufferMaximum)],
+            ICMPBufferSize = GlobalStaticConfiguration.LimitICMPBuffer(SettingsManager.Current.PortScanner_ICMPBuffer),
             ResolveHostname = SettingsManager.Current.PortScanner_ResolveHostname,
             ShowAllResults = SettingsManager.Current.PortScanner_ShowAllResults
         };
diff --git a/Source/NETworkManager/ViewModels/ProfileViewModel.cs b/Source/NETworkManager/ViewModels/ProfileViewModel.cs
index b810aef2ee..f6993ae211 100644
--- a/Source/NETworkManager/ViewModels/ProfileViewModel.cs
+++ b/Source/NETworkManager/ViewModels/ProfileViewModel.cs
@@ -14,6 +14,7 @@
 using System.Collections.Generic;
 using System.ComponentModel;
 using System.Linq;
+using System.Net;
 using System.Security;
 using System.Threading.Tasks;
 using System.Windows.Data;
@@ -1010,12 +1011,21 @@ private set
 
     /// <summary>
     /// Checks if the query type of the profile fits the host (own or inherited), see
-    /// <see cref="DNSLookup_QueryTypeIsValid"/>.
+    /// <see cref="DNSLookup_QueryTypeIsValid"/>. Every address the lookup can parse is valid (also shortened IPv4
+    /// forms like "127.1"), like in the DNS Lookup.
     /// </summary>
     private void ValidateDNSLookupQueryType()
     {
-        DNSLookup_QueryTypeIsValid = !DNSLookup_OverrideQueryType || DNSLookup_QueryType != QueryType.PTR ||
-                                     IPAddressHelper.AreIPAddresses(DNSLookup_InheritHost ? Host : DNSLookup_Host);
+        if (!DNSLookup_OverrideQueryType || DNSLookup_QueryType != QueryType.PTR)
+        {
+            DNSLookup_QueryTypeIsValid = true;
+            return;
+        }
+
+        var hosts = ((DNSLookup_InheritHost ? Host : DNSLookup_Host) ?? string.Empty).Split(';',
+            StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+
+        DNSLookup_QueryTypeIsValid = hosts.Length > 0 && hosts.All(x => IPAddress.TryParse(x, out _));
     }
 
     #endregion
diff --git a/Source/NETworkManager/ViewModels/TracerouteViewModel.cs b/Source/NETworkManager/ViewModels/TracerouteViewModel.cs
index 748b20836a..d125f1caba 100644
--- a/Source/NETworkManager/ViewModels/TracerouteViewModel.cs
+++ b/Source/NETworkManager/ViewModels/TracerouteViewModel.cs
@@ -420,9 +420,7 @@ await DNSClientHelper.ResolveAorAaaaAsync(Host,
         {
             var traceroute = new Traceroute(new TracerouteOptions(
                 SettingsManager.Current.Traceroute_Timeout,
-                // Limits of the input (a value edited in the settings file would throw or make every ping fail)
-                new byte[Math.Clamp(SettingsManager.Current.Traceroute_Buffer, 1,
-                    GlobalStaticConfiguration.ICMPBufferMaximum)],
+                GlobalStaticConfiguration.LimitICMPBuffer(SettingsManager.Current.Traceroute_Buffer),
                 SettingsManager.Current.Traceroute_MaximumHops,
                 true,
                 SettingsManager.Current.Traceroute_ResolveHostname,
diff --git a/Source/NETworkManager/ViewModels/WebConsoleSettingsViewModel.cs b/Source/NETworkManager/ViewModels/WebConsoleSettingsViewModel.cs
index bd52d3f4f2..45753fe5e2 100644
--- a/Source/NETworkManager/ViewModels/WebConsoleSettingsViewModel.cs
+++ b/Source/NETworkManager/ViewModels/WebConsoleSettingsViewModel.cs
@@ -149,6 +149,8 @@ private async Task DeleteBrowsingData()
 
         IsDeleteBrowsingDataStatusMessageDisplayed = false;
 
+        CoreWebView2Controller webView2Controller = null;
+
         try
         {
             // Create a temporary WebView2 instance to clear browsing data
@@ -157,12 +159,10 @@ private async Task DeleteBrowsingData()
 
             var windowHwnd = new WindowInteropHelper(Application.Current.MainWindow).Handle;
 
-            var webView2Controller = await webView2Environment.CreateCoreWebView2ControllerAsync(windowHwnd);
+            webView2Controller = await webView2Environment.CreateCoreWebView2ControllerAsync(windowHwnd);
 
             await webView2Controller.CoreWebView2.Profile.ClearBrowsingDataAsync();
 
-            webView2Controller.Close();
-
             DeleteBrowsingDataStatusMessage = Strings.BrowsingDataSuccessfullyDeletedMessage;
         }
         catch (Exception ex)
@@ -172,6 +172,11 @@ private async Task DeleteBrowsingData()
 
             DeleteBrowsingDataStatusMessage = Strings.BrowsingDataErrorMessage;
         }
+        finally
+        {
+            // Also on an error, otherwise the cache folder stays locked until the application is closed
+            webView2Controller?.Close();
+        }
 
         IsDeleteBrowsingDataStatusMessageDisplayed = true;
     }
diff --git a/Source/NETworkManager/Views/FirewallView.xaml.cs b/Source/NETworkManager/Views/FirewallView.xaml.cs
index 037f561b81..776bbad65f 100644
--- a/Source/NETworkManager/Views/FirewallView.xaml.cs
+++ b/Source/NETworkManager/Views/FirewallView.xaml.cs
@@ -53,7 +53,7 @@ private void ViewModel_PropertyChanged(object sender, PropertyChangedEventArgs e
     }
 
     /// <summary>
-    /// Set data context for menus.
+    /// Updates the selection dependent menu items when a context menu is opened.
     /// </summary>
     /// <param name="sender"></param>
     /// <param name="e"></param>
diff --git a/Source/NETworkManager/Views/PortScannerHostView.xaml b/Source/NETworkManager/Views/PortScannerHostView.xaml
index 8a820e112a..834c438ed3 100644
--- a/Source/NETworkManager/Views/PortScannerHostView.xaml
+++ b/Source/NETworkManager/Views/PortScannerHostView.xaml
@@ -23,6 +23,7 @@
         <converters:IntNotZeroToVisibilityCollapsedConverter x:Key="IntNotZeroToVisibilityCollapsedConverter" />
         <converters:IntZeroToVisibilityCollapsedConverter x:Key="IntZeroToVisibilityCollapsedConverter" />
         <converters:StringNullOrEmptyToBoolConverter x:Key="StringNullOrEmptyToBoolConverter" />
+        <converters:ProfileToPortScannerPortsConverter x:Key="ProfileToPortScannerPortsConverter" />
         <wpfHelpers:BindingProxy x:Key="BindingProxy" Data="{Binding}" />
         <DataTemplate x:Key="PortScannerProfileItemTemplate" DataType="{x:Type profiles:ProfileInfo}">
             <Grid Background="Transparent">
@@ -33,7 +34,8 @@
                                 <TextBlock.Text>
                                     <MultiBinding StringFormat="{}{0}:{1}">
                                         <Binding Path="PortScanner_Host" />
-                                        <Binding Path="PortScanner_Ports" />
+                                        <!-- Own ports, otherwise the ports of the group (port profiles with their current name) -->
+                                        <Binding Converter="{StaticResource ProfileToPortScannerPortsConverter}" />
                                     </MultiBinding>
                                 </TextBlock.Text>
                             </TextBlock>
diff --git a/Source/NETworkManager/Views/SNMPView.xaml b/Source/NETworkManager/Views/SNMPView.xaml
index aecf87e9d0..1fb606ce28 100644
--- a/Source/NETworkManager/Views/SNMPView.xaml
+++ b/Source/NETworkManager/Views/SNMPView.xaml
@@ -102,9 +102,6 @@
                       x:Name="ComboBoxOid"
                       ItemsSource="{Binding OidHistoryView}"
                       IsReadOnly="{Binding IsRunning}">
-                <ComboBox.Resources>
-                    <wpfHelpers:BindingProxy x:Key="BindingProxy" Data="{Binding}" />
-                </ComboBox.Resources>
                 <ComboBox.Style>
                     <Style TargetType="{x:Type ComboBox}" BasedOn="{StaticResource HistoryComboBox}">
                         <Setter Property="mah:TextBoxHelper.Watermark"
diff --git a/Source/NETworkManager/Views/ServerConnectionInfoProfileChildWindow.xaml b/Source/NETworkManager/Views/ServerConnectionInfoProfileChildWindow.xaml
index b60295b62e..119492eab3 100644
--- a/Source/NETworkManager/Views/ServerConnectionInfoProfileChildWindow.xaml
+++ b/Source/NETworkManager/Views/ServerConnectionInfoProfileChildWindow.xaml
@@ -49,9 +49,6 @@
             <TextBox x:Name="TextBoxName" Grid.Column="2" Grid.Row="0"
                    IsReadOnly="{Binding IsNameReadOnly}"
                    mah:TextBoxHelper.Watermark="{x:Static localization:StaticStrings.ExampleGroupServers}">
-                <TextBox.Resources>
-                    <wpfHelpers:BindingProxy x:Key="BindingProxy" Data="{Binding}" />
-                </TextBox.Resources>
                 <TextBox.Text>
                     <Binding Path="Name" Mode="TwoWay" UpdateSourceTrigger="PropertyChanged">
                         <Binding.ValidationRules>
@@ -116,9 +113,6 @@
             <TextBox x:Name="TextBoxServer" Grid.Column="0" Grid.Row="0"
                    mah:TextBoxHelper.Watermark="{Binding ServerWatermark}"
                    PreviewKeyDown="TextBoxServerOrPort_PreviewKeyDown">
-                <TextBox.Resources>
-                    <wpfHelpers:BindingProxy x:Key="BindingProxy" Data="{Binding}" />
-                </TextBox.Resources>
                 <TextBox.Text>
                     <Binding Path="Server" Mode="TwoWay" UpdateSourceTrigger="PropertyChanged">
                         <Binding.ValidationRules>
diff --git a/Website/docs/changelog/next-release.md b/Website/docs/changelog/next-release.md
index 725b8ce9f3..045f3d8781 100644
--- a/Website/docs/changelog/next-release.md
+++ b/Website/docs/changelog/next-release.md
@@ -66,7 +66,7 @@ Release date: **xx.xx.2026**
 - Added a live count of hosts up/down next to the **Result** header. Stays visible after the scan finishes. [#3572](https://github.com/BornToBeRoot/NETworkManager/pull/3572)
 - Host input now accepts newline-separated hosts (one per line, e.g. a column pasted from Excel), converted automatically to the semicolon-separated form. Thanks to [@dearmb](https://github.com/dearmb) [#3568](https://github.com/BornToBeRoot/NETworkManager/pull/3568)
 - Host input now supports shorthand IPv4 ranges like `192.168.0.1-100`, in addition to the existing `192.168.0.0-192.168.0.100` and `192.168.[0-100].1` range formats. [#3568](https://github.com/BornToBeRoot/NETworkManager/pull/3568)
-- Added `21` (FTP, e.g. NAS), `23` (Telnet, e.g. older switches), `135` (RPC), `554` (RTSP, e.g. IP cameras), `631` (IPP, printers), `5900` (VNC), `5985` (WinRM), `7000` (AirPlay), `8009` (Chromecast), `8080` / `8443` (web interfaces of devices and appliances), `9100` (raw printing) and `62078` (iPhone / iPad) to the default **Ports** list used to detect if a host is reachable, e.g. hosts that block ICMP. An unreachable host is still finished after about 4 seconds (22 ports with **Max. concurrent port threads** `16`, like 2 ICMP attempts). Settings that are still on the old default are updated. [#3564](https://github.com/BornToBeRoot/NETworkManager/pull/3564)
+- Added `21` (FTP, e.g. NAS), `23` (Telnet, e.g. older switches), `135` (RPC), `554` (RTSP, e.g. IP cameras), `631` (IPP, printers), `5900` (VNC), `5985` (WinRM), `7000` (AirPlay), `8009` (Chromecast), `8080` / `8443` (web interfaces of devices and appliances), `9100` (raw printing) and `62078` (iPhone / iPad) to the default **Ports** list used to detect if a host is reachable, e.g. hosts that block ICMP. An unreachable host is still finished after about 4 seconds (22 ports with **Max. concurrent port threads** `16`, like 2 ICMP attempts). Settings that are still on the old default are updated. [#3564](https://github.com/BornToBeRoot/NETworkManager/pull/3564) [#3667](https://github.com/BornToBeRoot/NETworkManager/pull/3667)
 - Added a button next to **Ports** in the settings to restore the default ports. [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
 - New default custom commands **Windows Explorer (shares)**, **Computer Management**, **Event Viewer** and **System Information** (for new settings; existing custom commands are not changed). [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
 - Faster scans with new defaults: all ports of a host are now scanned at the same time (**Max. concurrent port threads** `5` → `16`, max. `32`) and the timeouts are lower (**ICMP**, **port scan** and **NetBIOS** timeout `4000` → `2000` ms), so an unreachable host is finished after about 4 seconds (2 ICMP attempts) instead of up to 12 seconds. **Max. concurrent host threads** is lowered from `256` to `128` (max. `256` instead of `512`) to put less simultaneous load on the network. An empty `/24` network is scanned in about 8 seconds instead of about 50. Settings that are still on the old default are updated. [#3564](https://github.com/BornToBeRoot/NETworkManager/pull/3564) [#3653](https://github.com/BornToBeRoot/NETworkManager/pull/3653)
@@ -110,10 +110,10 @@ Release date: **xx.xx.2026**
 - Several port profiles can be selected in the settings and deleted at once (context menu or `Del`), the confirmation lists them. [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
 - Added a search box above the result to filter the ports by IP address, hostname, port, protocol, service, description and status, also while the scan is running. [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
 - **Copy** > **IP address** / **Hostname** / **Port** / **IP address:Port** is available if multiple results are selected (one value per line, in the order shown). [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
-- New setting **Ping hosts before the scan** (default off): only hosts that answer a ping are scanned, the number of skipped hosts is shown after the scan. The ping has its own **Attempts** (default `2`), **Timeout** (default `2000` ms) and **Buffer** (default `32` bytes) settings, like the IP Scanner. Faster for ranges with many unused IP addresses; hosts that block ICMP are skipped. [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
+- New setting **Ping hosts before the scan** (default off): only hosts that answer a ping are scanned, the number of skipped hosts is shown after the scan. The ping has its own **Attempts** (default `2`), **Timeout** (default `2000` ms) and **Buffer** (default `32` bytes) settings, like the IP Scanner. Faster for ranges with many unused IP addresses; hosts that block ICMP are skipped. [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660) [#3667](https://github.com/BornToBeRoot/NETworkManager/pull/3667)
 - New setting **Adjust threads automatically** (default on): the number of hosts and ports scanned at the same time is adjusted to the scan (up to `512` connections, at most `128` hosts and `128` ports per host). A scan with few ports is much faster, e.g. a `/24` with one port (e.g. `3389`) takes about 4 seconds instead of about 2 minutes; `1-1024` is unchanged. **Max. concurrent host threads** (now up to `256`) and **Max. concurrent port threads** are used if it is disabled, with at most `8,192` connections at the same time. It is disabled when updating if the threads were changed. The hostname (DNS `PTR`) of a host is resolved when its first port is scanned, so the lookups are spread over time like the ports. [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
 - Added a new **Well-known ports** (`1-1024`) default port profile. [#3564](https://github.com/BornToBeRoot/NETworkManager/pull/3564)
-- Groups: new **Ports** setting (ports, port ranges and port profiles) for the Port Scanner, used by the profiles of the group that don't override them (new **Ports** checkbox in the profile, like the other settings that can be set in the group). Existing profiles with ports keep them (the checkbox is enabled when the profile file is loaded).
+- Groups: new **Ports** setting (ports, port ranges and port profiles) for the Port Scanner, used by the profiles of the group that don't override them (new **Ports** checkbox in the profile, like the other settings that can be set in the group). Existing profiles with ports keep them (the checkbox is enabled when the profile file is loaded). [#3667](https://github.com/BornToBeRoot/NETworkManager/pull/3667)
 - The export runs in the background, so the window stays responsive while a large result is exported, and uses the order shown in the result (sorting, grouping) instead of the order in which the ports were scanned. [#3653](https://github.com/BornToBeRoot/NETworkManager/pull/3653)
 - Ports are started one after another (every 1 ms, shorter with short timeouts and many threads) instead of all at the same moment. This avoids bursts of hundreds of connection requests within a few milliseconds and makes the progress smoother. [#3653](https://github.com/BornToBeRoot/NETworkManager/pull/3653)
 
@@ -132,7 +132,7 @@ Release date: **xx.xx.2026**
 
 **DNS Lookup**
 
-- Profiles: new option **DNS server** to use a DNS server of the profile instead of the one selected in the DNS lookup, with the same list and `Tab` completion. It can also be set in the group (used by the profiles of the group that don't override it). New option **Type** (record type) in the profile; without it, a profile is looked up with `PTR` for IP addresses and `A` for hostnames instead of the last selected record type. Configured DNS servers are referenced by the profile (changes apply, also after a rename), their IP addresses are saved as well and used, with a note, if the DNS server can't be found (e.g. a profile file shared from another computer). [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
+- Profiles: new option **DNS server** to use a DNS server of the profile instead of the one selected in the DNS lookup, with the same list and `Tab` completion. It can also be set in the group (used by the profiles of the group that don't override it). New option **Type** (record type) in the profile; without it, a profile is looked up with `PTR` for IP addresses and `A` for hostnames instead of the last selected record type. Configured DNS servers are referenced by the profile (changes apply, also after a rename), their IP addresses are saved as well and used, with a note, if the DNS server can't be found (e.g. a profile file shared from another computer). [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660) [#3667](https://github.com/BornToBeRoot/NETworkManager/pull/3667)
 - Several DNS servers can be entered, also names of configured DNS servers together with custom DNS servers (e.g. `Google Public DNS; Cloudflare; 9.9.9.9`), every DNS server is queried once; `[Windows DNS]` in a list adds the DNS servers of Windows. The list of the **DNS server** input shows the history and the configured DNS servers (name, with the IP addresses below), `Tab` completes the name of a DNS server that is being typed (e.g. `google; cl` → `google; Cloudflare`). The name of a DNS server must not contain `;` (replaced by `,` when updating). Also with the run command (`dns borntoberoot.net "Google Public DNS";cloudflare`). [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
 - IP addresses opened from another feature (e.g. **IP Scanner** > **DNS lookup** > **IP address**), from a profile or with the run command are looked up with `PTR` instead of the selected record type. [#3644](https://github.com/BornToBeRoot/NETworkManager/pull/3644)
 
@@ -192,7 +192,7 @@ Release date: **xx.xx.2026**
 
 **Firewall**
 
-- Fixed the name of the feature not being translatable in the list of features, the settings and the run command (missing translation key).
+- Fixed the name of the feature not being translatable in the list of features, the settings and the run command (missing translation key). [#3667](https://github.com/BornToBeRoot/NETworkManager/pull/3667)
 - Fixed `F5` not refreshing the rule list, although it is documented as shortcut. [#3637](https://github.com/BornToBeRoot/NETworkManager/pull/3637)
 - Fixed an empty rule list with "Reloaded at ..." being shown if the rules could not be loaded (e.g. the Windows Firewall service is not running). An error is shown now, and a message if the rules could only be loaded partially. [#3637](https://github.com/BornToBeRoot/NETworkManager/pull/3637)
 - Fixed the Firewall not working until the application was restarted if loading the PowerShell module `NetSecurity` failed once. [#3637](https://github.com/BornToBeRoot/NETworkManager/pull/3637)
@@ -258,7 +258,7 @@ Release date: **xx.xx.2026**
 - Fixed a DNS server opened with the run command in another case than configured (e.g. `cloudflare` for `Cloudflare`) being looked up as hostname instead of using the configured DNS server. Names of DNS servers are case-insensitive now. [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
 - Fixed **Add DNS suffix (primary) to hostname** silently appending no suffix at all on machines without a Windows primary DNS suffix configured (e.g. not domain-joined), even though a usable suffix was available via the active network adapter's connection-specific DNS suffix (shown under **DNS Suffix Search List** in `ipconfig /all`). It now falls back to that adapter's suffix in this case. [#3591](https://github.com/BornToBeRoot/NETworkManager/pull/3591)
 - Fixed columns that couldn't be made wider than the window (by dragging or double-clicking the gripper) in the result and the DNS server profiles in the settings. The grid scrolls horizontally now, the last (or main) column still fills the remaining width. [#3557](https://github.com/BornToBeRoot/NETworkManager/issues/3557)
-- Fixed a technical error (*An invalid IP address was specified*) being shown for a hostname looked up with `PTR`. A message is shown and the hostname is skipped, the other hosts are looked up.
+- Fixed a technical error (*An invalid IP address was specified*) being shown for a hostname looked up with `PTR`. A message is shown and the hostname is skipped, the other hosts are looked up. [#3667](https://github.com/BornToBeRoot/NETworkManager/pull/3667)
 
 **IP Scanner**
 
@@ -347,8 +347,8 @@ Release date: **xx.xx.2026**
 
 - Fixed `Enter` in the search box of the import result importing the profiles (default button). It filters the found profiles right away now, instead of after the delay while typing. [#3660](https://github.com/BornToBeRoot/NETworkManager/pull/3660)
 - Fixed columns that couldn't be made wider than the window (by dragging or double-clicking the gripper) in the groups (Settings > Profiles) and the import result. The grid scrolls horizontally now, the last (or main) column still fills the remaining width. [#3557](https://github.com/BornToBeRoot/NETworkManager/issues/3557)
-- Fixed the names of the features in the group dialog shown without spaces (e.g. `RemoteDesktop` instead of **Remote Desktop**).
-- Fixed the profiles of a group renamed only by case (e.g. `servers` → `Servers`) keeping the old group name. Opening them in a feature with group settings (e.g. **Remote Desktop**, **PuTTY**) failed, and editing one could create a second group with the old name. Profile files with such profiles are repaired when they are loaded.
+- Fixed the names of the features in the group dialog shown without spaces (e.g. `RemoteDesktop` instead of **Remote Desktop**). [#3667](https://github.com/BornToBeRoot/NETworkManager/pull/3667)
+- Fixed the profiles of a group renamed only by case (e.g. `servers` → `Servers`) keeping the old group name. Opening them in a feature with group settings (e.g. **Remote Desktop**, **PuTTY**) failed, and editing one could create a second group with the old name. Profile files with such profiles are repaired when they are loaded. [#3667](https://github.com/BornToBeRoot/NETworkManager/pull/3667)
 
 **SNMP**