diff --git a/kernel/rtlil_bufnorm.cc b/kernel/rtlil_bufnorm.cc
index f2042f361..e2d0eae9f 100644
--- a/kernel/rtlil_bufnorm.cc
+++ b/kernel/rtlil_bufnorm.cc
@@ -1057,7 +1057,7 @@ void RTLIL::Cell::unsetPort(const RTLIL::IdString& portname)
 void RTLIL::Cell::setPort(const RTLIL::IdString& portname, RTLIL::SigSpec signal)
 {
 	bool is_input_port = false;
-	if (module->sig_norm_index != nullptr) {
+	if (module->sig_norm_index != nullptr && type != ID($specify2)) {
 		module->sig_norm_index->sigmap.apply(signal);
 		auto dir = port_dir(portname);
 
diff --git a/kernel/timinginfo.h b/kernel/timinginfo.h
index 71582495b..ff60415bd 100644
--- a/kernel/timinginfo.h
+++ b/kernel/timinginfo.h
@@ -106,10 +106,9 @@ struct TimingInfo
 				for (const auto &c : src.chunks())
 					if (!c.wire || !c.wire->port_input)
 						log_error("Module '%s' contains specify cell '%s' where SRC '%s' is not a module input.\n", log_id(module), log_id(cell), log_signal(src));
-				// TODO disabled check because signorm breaks this assumption
-				// for (const auto &c : dst.chunks())
-				// 	if (!c.wire || !c.wire->port_output)
-				// 		log_error("Module '%s' contains specify cell '%s' where DST '%s' is not a module output.\n", log_id(module), log_id(cell), log_signal(dst));
+				for (const auto &c : dst.chunks())
+					if (!c.wire || !c.wire->port_output)
+						log_error("Module '%s' contains specify cell '%s' where DST '%s' is not a module output.\n", log_id(module), log_id(cell), log_signal(dst));
 				int rise_max = cell->getParam(ID::T_RISE_MAX).as_int();
 				int fall_max = cell->getParam(ID::T_FALL_MAX).as_int();
 				int max = std::max(rise_max,fall_max);