diff --git a/Makefile b/Makefile
index 63e5a88d7..1fcd19149 100644
--- a/Makefile
+++ b/Makefile
@@ -141,7 +141,7 @@ LDLIBS += -lrt
 endif
 endif
 
-YOSYS_VER := 0.28+4
+YOSYS_VER := 0.28+6
 
 # Note: We arrange for .gitcommit to contain the (short) commit hash in
 # tarballs generated with git-archive(1) using .gitattributes. The git repo
diff --git a/backends/aiger/xaiger.cc b/backends/aiger/xaiger.cc
index e223f185e..68c2ff52f 100644
--- a/backends/aiger/xaiger.cc
+++ b/backends/aiger/xaiger.cc
@@ -274,6 +274,10 @@ struct XAigerWriter
 						continue;
 					auto offset = i.first.offset;
 
+					auto rhs = cell->getPort(i.first.name);
+					if (offset >= rhs.size())
+						continue;
+
 #ifndef NDEBUG
 					if (ys_debug(1)) {
 						static pool<std::pair<IdString,TimingInfo::NameBit>> seen;
@@ -281,7 +285,7 @@ struct XAigerWriter
 								log_id(cell->type), log_id(i.first.name), offset, d);
 					}
 #endif
-					arrival_times[cell->getPort(i.first.name)[offset]] = d;
+					arrival_times[rhs[offset]] = d;
 				}
 
 				if (abc9_flop)
diff --git a/frontends/ast/ast.cc b/frontends/ast/ast.cc
index 5a2ade04a..91001c70d 100644
--- a/frontends/ast/ast.cc
+++ b/frontends/ast/ast.cc
@@ -847,7 +847,7 @@ RTLIL::Const AstNode::bitsAsConst(int width, bool is_signed)
 		bits.resize(width);
 	if (width >= 0 && width > int(bits.size())) {
 		RTLIL::State extbit = RTLIL::State::S0;
-		if (is_signed && !bits.empty())
+		if ((is_signed || is_unsized) && !bits.empty())
 			extbit = bits.back();
 		while (width > int(bits.size()))
 			bits.push_back(extbit);
diff --git a/passes/techmap/abc9_ops.cc b/passes/techmap/abc9_ops.cc
index 9766e81cb..ed4d4bdfb 100644
--- a/passes/techmap/abc9_ops.cc
+++ b/passes/techmap/abc9_ops.cc
@@ -674,8 +674,12 @@ void prep_delays(RTLIL::Design *design, bool dff_mode)
 				continue;
 
 			auto offset = i.first.offset;
-			auto O = module->addWire(NEW_ID);
+			if (!cell->hasPort(i.first.name))
+				continue;
 			auto rhs = cell->getPort(i.first.name);
+			if (offset >= rhs.size())
+				continue;
+			auto O = module->addWire(NEW_ID);
 
 #ifndef NDEBUG
 			if (ys_debug(1)) {
diff --git a/tests/arch/xilinx/bug3670.v b/tests/arch/xilinx/bug3670.v
new file mode 100644
index 000000000..c7dd18079
--- /dev/null
+++ b/tests/arch/xilinx/bug3670.v
@@ -0,0 +1,13 @@
+module bug3670(input we, output [31:0] o1, o2, output o3);
+    // Completely missing port connections, where first affected port
+    // (ADDRARDADDR) has a $setup delay
+    RAMB36E1 ram1(.DOADO(o1));
+
+    // Under-specified input port connections (WEA is 4 bits) which
+    // has a $setup delay
+    RAMB36E1 ram2(.WEA(we), .DOADO(o2));
+
+    // Under-specified output port connections (DOADO is 32 bits)
+    // with clk-to-q delay
+    RAMB36E1 ram3(.DOADO(o3));
+endmodule
diff --git a/tests/arch/xilinx/bug3670.ys b/tests/arch/xilinx/bug3670.ys
new file mode 100644
index 000000000..772072c1e
--- /dev/null
+++ b/tests/arch/xilinx/bug3670.ys
@@ -0,0 +1,3 @@
+read_verilog bug3670.v
+read_verilog -lib -specify +/xilinx/cells_sim.v
+abc9
diff --git a/tests/verilog/unbased_unsized_shift.sv b/tests/verilog/unbased_unsized_shift.sv
new file mode 100644
index 000000000..475e9a75d
--- /dev/null
+++ b/tests/verilog/unbased_unsized_shift.sv
@@ -0,0 +1,28 @@
+module pass_through(
+    input [63:0] inp,
+    output [63:0] out
+);
+    assign out = inp;
+endmodule
+
+module top;
+    logic [63:0] s0c, s1c, sxc, s0d, s1d, sxd, d;
+
+    pass_through pt(8, d);
+
+    assign s0c = '0 << 8;
+    assign s1c = '1 << 8;
+    assign sxc = 'x << 8;
+    assign s0d = '0 << d;
+    assign s1d = '1 << d;
+    assign sxd = 'x << d;
+
+    always @* begin
+        assert (s0c === 64'h0000_0000_0000_0000);
+        assert (s1c === 64'hFFFF_FFFF_FFFF_FF00);
+        assert (sxc === 64'hxxxx_xxxx_xxxx_xx00);
+        assert (s0d === 64'h0000_0000_0000_0000);
+        assert (s1d === 64'hFFFF_FFFF_FFFF_FF00);
+        assert (sxd === 64'hxxxx_xxxx_xxxx_xx00);
+    end
+endmodule
diff --git a/tests/verilog/unbased_unsized_shift.ys b/tests/verilog/unbased_unsized_shift.ys
new file mode 100644
index 000000000..c36049600
--- /dev/null
+++ b/tests/verilog/unbased_unsized_shift.ys
@@ -0,0 +1,7 @@
+read_verilog -sv unbased_unsized_shift.sv
+hierarchy
+proc
+flatten
+opt -full
+select -module top
+sat -verify -seq 1 -tempinduct -prove-asserts -show-all