diff --git a/src/core/efw/DatabaseExperiment.cc b/src/core/efw/DatabaseExperiment.cc
index 82fccf24..93736d1d 100644
--- a/src/core/efw/DatabaseExperiment.cc
+++ b/src/core/efw/DatabaseExperiment.cc
@@ -109,28 +109,29 @@ bool DatabaseExperiment::run()
 
 			simulator.clearListeners();
 
-			// Generate an experiment listener, that matches on any IP
-			// event. It is used to forward to the injection
-			// point. The +1 is needed, since even for the zeroth
-			// dynamic instruction we need at least one breakpoint
-			// event.
-			BPSingleListener bp;
-			bp.setWatchInstructionPointer(ANY_ADDR);
-			bp.setCounter(injection_instr + 1);
-			simulator.addListener(&bp);
-
 			if (!this->cb_before_fast_forward()) {
 				continue;
 			}
-			fail::BaseListener * listener;
-			while (true) {
-				listener = simulator.resume();
-				if (listener == &bp) {
-					break;
-				} else {
-					bool should_continue = this->cb_during_fast_forward(listener);
-					if (!should_continue)
-						break; // Stop fast forwarding
+
+			// Do we need to fast-forward at all?
+			if (injection_instr > 0) {
+				// Create a listener that matches any IP event. It is used to
+				// forward to the injection point.
+				BPSingleListener bp;
+				bp.setWatchInstructionPointer(ANY_ADDR);
+				bp.setCounter(injection_instr);
+				simulator.addListener(&bp);
+
+				fail::BaseListener * listener;
+				while (true) {
+					listener = simulator.resume();
+					if (listener == &bp) {
+						break;
+					} else {
+						bool should_continue = this->cb_during_fast_forward(listener);
+						if (!should_continue)
+							break; // Stop fast forwarding
+					}
 				}
 			}
 			if (!this->cb_after_fast_forward(listener)) {
diff --git a/src/experiments/cored-tester/experiment.cc b/src/experiments/cored-tester/experiment.cc
index 0e8a486d..a5cc698a 100644
--- a/src/experiments/cored-tester/experiment.cc
+++ b/src/experiments/cored-tester/experiment.cc
@@ -321,18 +321,22 @@ bool CoredTester::run() {
 			simulator.addListener(&l_fail_trace);
 
 			BPSingleListener bp;
-			bp.setWatchInstructionPointer(ANY_ADDR);
-			// TODO: why does this need a +1?
-			bp.setCounter(injection_instr+1);
-			simulator.addListener(&bp);
-
-			fail::BaseListener * listener = simulator.resume();
+			fail::BaseListener *listener = 0;
 			bool ok = true;
 
-			while ( ok && (listener == &l_fail_trace) ) {
-				// m_log << "CP IP 0x" << std::hex << simulator.getCPU(0).getInstructionPointer() << std::endl;
-				ok = cpoint.check(s_fail_trace, l_fail_trace.getTriggerInstructionPointer()) == Checkpoint::IDENTICAL;
-				if(ok) listener = simulator.addListenerAndResume(&l_fail_trace);
+			// do we have to fast-forward at all?
+			if (injection_instr > 0) {
+				bp.setWatchInstructionPointer(ANY_ADDR);
+				bp.setCounter(injection_instr);
+				simulator.addListener(&bp);
+
+				listener = simulator.resume();
+
+				while ( ok && (listener == &l_fail_trace) ) {
+					// m_log << "CP IP 0x" << std::hex << simulator.getCPU(0).getInstructionPointer() << std::endl;
+					ok = cpoint.check(s_fail_trace, l_fail_trace.getTriggerInstructionPointer()) == Checkpoint::IDENTICAL;
+					if(ok) listener = simulator.addListenerAndResume(&l_fail_trace);
+				}
 			}
 
 			unsigned experiment_number = cpoint.getCount();
@@ -347,7 +351,7 @@ bool CoredTester::run() {
 
 				break;
 			}
-			if (listener != &bp) {
+			if (listener != &bp && injection_instr > 0) {
 				result = param.msg.add_result();
 				handleEvent(*result, result->NOINJECTION, "WTF");
 
diff --git a/src/experiments/cored-voter/experiment.cc b/src/experiments/cored-voter/experiment.cc
index a09af3ad..75c9d16b 100644
--- a/src/experiments/cored-voter/experiment.cc
+++ b/src/experiments/cored-voter/experiment.cc
@@ -349,11 +349,11 @@ bool CoredVoter::run() {
             // Fast forward to injection address
 			m_log << "Trying to inject @ instr #" << dec << injection_instr << endl;
 
-			if ((injection_instr + 2) > 0) {
+			if (injection_instr > 0) {
 				simulator.clearListeners();
                 BPSingleListener bp;
 				bp.setWatchInstructionPointer(ANY_ADDR);
-				bp.setCounter(injection_instr + 2); // FIXME: FISHY!
+				bp.setCounter(injection_instr);
 				simulator.addListener(&bp);
 
                 fail::BaseListener * listener = simulator.resume();
diff --git a/src/experiments/dciao-kernelstructs/experiment.cc b/src/experiments/dciao-kernelstructs/experiment.cc
index f3bb3da2..1b360e9f 100644
--- a/src/experiments/dciao-kernelstructs/experiment.cc
+++ b/src/experiments/dciao-kernelstructs/experiment.cc
@@ -197,7 +197,7 @@ bool DCIAOKernelStructs::run() {
 				simulator.addListener(&l_time_marker_print);
 
 				bp.setWatchInstructionPointer(ANY_ADDR);
-				bp.setCounter(injection_instr+1);
+				bp.setCounter(injection_instr);
 				simulator.addListener(&bp);
 
 				// Add vport listener
diff --git a/src/experiments/fiascoFail/experiment.cc b/src/experiments/fiascoFail/experiment.cc
index b9cac1c4..16237200 100644
--- a/src/experiments/fiascoFail/experiment.cc
+++ b/src/experiments/fiascoFail/experiment.cc
@@ -253,7 +253,7 @@ bool FiascoFailExperiment::faultInjection()
 			if(instr_offset > 0)
 			{
 				bp.setWatchInstructionPointer(ANY_ADDR);					// Create new Breakpoint...
-				bp.setCounter(instr_offset + 1);						// ...to break when the IP for the fault injection is reached...
+				bp.setCounter(instr_offset);						// ...to break when the IP for the fault injection is reached...
 				simulator.addListener(&bp);							// ...and add it to the actual listeners
 
 				BaseListener *go = waitIOOrOther(true);						// Resume simulation and log VGA-Output
diff --git a/src/experiments/kesogc/experiment.cc b/src/experiments/kesogc/experiment.cc
index 19f60219..30d0eacb 100644
--- a/src/experiments/kesogc/experiment.cc
+++ b/src/experiments/kesogc/experiment.cc
@@ -187,8 +187,7 @@ bool KESOgc::run()
                 BPSingleListener bp;
 				bp.setWatchInstructionPointer(ANY_ADDR);
 				
-				// Fix offset by 1 error
-				bp.setCounter(injection_instr + 1);
+				bp.setCounter(injection_instr);
 				
 				simulator.addListener(&bp);
 
diff --git a/src/experiments/kesorefs/experiment.cc b/src/experiments/kesorefs/experiment.cc
index 0e1e9a84..ef39088f 100644
--- a/src/experiments/kesorefs/experiment.cc
+++ b/src/experiments/kesorefs/experiment.cc
@@ -161,7 +161,7 @@ bool KESOrefs::run()
 
                 BPSingleListener bp;
 				bp.setWatchInstructionPointer(ANY_ADDR);
-				bp.setCounter(injection_instr + 1);
+				bp.setCounter(injection_instr);
 				simulator.addListener(&bp);
 
 				bool inject = true;
diff --git a/src/experiments/vezs-example/experiment.cc b/src/experiments/vezs-example/experiment.cc
index d5267793..b0759f85 100644
--- a/src/experiments/vezs-example/experiment.cc
+++ b/src/experiments/vezs-example/experiment.cc
@@ -160,8 +160,7 @@ bool VEZSExperiment::run()
                 BPSingleListener bp;
 				bp.setWatchInstructionPointer(ANY_ADDR);
 				
-				// Fix offset by 1 error
-				bp.setCounter(injection_instr + 1);
+				bp.setCounter(injection_instr);
 				
 				simulator.addListener(&bp);