diff --git a/CHANGELOG.md b/CHANGELOG.md
index b66c3013..2a27ca20 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,9 @@
 
 ## Fixed
 
+- Health
+  - `HEALTH=1` builds no longer write past the phase timing arrays at the LLDP checkpoint, which
+    corrupted the `link` slow counter and the DHCP client state. #658
 - Config
   - A startup configuration line longer than the command buffer no longer stops the replay:
     the offending line is skipped and the following lines are still applied.
diff --git a/cmd_parser.c b/cmd_parser.c
index afc7831a..f8420379 100644
--- a/cmd_parser.c
+++ b/cmd_parser.c
@@ -2329,6 +2329,7 @@ void health_show(void) __banked
 	ph_line("tx  ", HEALTH_PH_TX);
 	ph_line("stp ", HEALTH_PH_STP);
 	ph_line("cmd ", HEALTH_PH_CMD);
+	ph_line("lldp", HEALTH_PH_LLDP);
 
 	/* Stack: current depth plus how much of the painted area is untouched */
 	print_string("sp ");
diff --git a/cmd_parser.h b/cmd_parser.h
index 2359eb16..e6a073ab 100644
--- a/cmd_parser.h
+++ b/cmd_parser.h
@@ -19,8 +19,8 @@ extern __xdata uint8_t err_status;
 #define HEALTH_PH_TX	3
 #define HEALTH_PH_STP	4
 #define HEALTH_PH_CMD	5
-#define HEALTH_PHASES	6
-#define HEALTH_LLDP     7
+#define HEALTH_PH_LLDP	6
+#define HEALTH_PHASES	(HEALTH_PH_LLDP + 1)	/* last id + 1: sizes the arrays in cmd_parser.c */
 
 extern __xdata uint16_t health_rx_frames;
 #define health_rx_frame()	health_rx_frames++
diff --git a/doc/health.md b/doc/health.md
index 736d52b7..af6b8a28 100644
--- a/doc/health.md
+++ b/doc/health.md
@@ -14,6 +14,7 @@ rx   max 00 slow 0x0000
 tx   max 00 slow 0x0000
 stp  max 04 slow 0x0001
 cmd  max 02 slow 0x0001
+lldp max 00 slow 0x0000
 sp 80 untouched 62
 tcp st 00 tmr 00 rtx 00 rto 00 len 0x0000 mss 0x05b4
   lport 0x0000 rport 0x0000 rip 0x0000 0x0000
@@ -46,7 +47,7 @@ a flooded CPU port from a stalled loop, which look identical from outside.
 ## Phases
 
 Each line is one section of the main loop: the link poll, SFP handling,
-frame reception, TCP transmission, the STP timers and the command dispatch.
+frame reception, TCP transmission, the STP timers, the LLDP timer and the command dispatch.
 `max` is the worst time that section has taken, in ticks of 5 ms; `slow`
 counts the passes that took two ticks or more. A misbehaving subsystem
 names itself here, which is the difference between knowing that the loop is
diff --git a/rtlplayground.c b/rtlplayground.c
index 0afa93c8..fbb94d76 100644
--- a/rtlplayground.c
+++ b/rtlplayground.c
@@ -1203,7 +1203,7 @@ static void handle_tick(void)
 		lacp_timers();
 	health_phase(HEALTH_PH_STP);
 	lldp_tick();
-	health_phase(HEALTH_LLDP);
+	health_phase(HEALTH_PH_LLDP);
 	cabletest_tick();
 }