diff --git a/src/prism2/sta_cs/hfa384x.c b/src/prism2/sta_cs/hfa384x.c
index 4ec1748..1eda02b 100644
--- a/src/prism2/sta_cs/hfa384x.c
+++ b/src/prism2/sta_cs/hfa384x.c
@@ -685,7 +685,7 @@ int hfa384x_drvr_flashdl_enable(hfa384x_t *hw)
 	}
 	hw->bufinfo.page = hfa384x2host_16(hw->bufinfo.page);
 	hw->bufinfo.offset = hfa384x2host_16(hw->bufinfo.offset);
-	hw->bufinfo.len = hfa384x2host_16(hw->bufinfo.offset);
+	hw->bufinfo.len = hfa384x2host_16(hw->bufinfo.len);
 	if ( (result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME, 
 				&(hw->dltimeout))) ) {
 		return result;
@@ -800,15 +800,15 @@ int hfa384x_drvr_flashdl_write(hfa384x_t *hw, UINT32 daddr, void* buf, UINT32 le
 
 	WLAN_LOG_INFO2("Download %ld bytes to flash @0x%06lx\n", len, daddr);
 
-	/* Figure out how many times to to the flash prog */
-	nwrites = len / hw->bufinfo.len;
-	nwrites += (len % hw->bufinfo.len) ? 1 : 0;
-
 	/* For convenience */
 	dlbufaddr = (hw->bufinfo.page << 7) | hw->bufinfo.offset;
 	verbuf = kmalloc(hw->bufinfo.len, GFP_KERNEL);
 
 WLAN_LOG_DEBUG3(1,"dlbuf@0x%06lx len=%d to=%d\n", dlbufaddr, hw->bufinfo.len, hw->dltimeout);
+	/* Figure out how many times to to the flash prog */
+	nwrites = len / hw->bufinfo.len;
+	nwrites += (len % hw->bufinfo.len) ? 1 : 0;
+
 	if ( verbuf == NULL ) {
 		WLAN_LOG_ERROR0("Failed to allocate flash verify buffer\n");
 		return 1;