The length was being set to whatever the last nl80211 attribute was, not the length for the RESP_IE iteration. --- src/netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/netdev.c b/src/netdev.c index 4dc9ce94..cda0c7fc 100644 --- a/src/netdev.c +++ b/src/netdev.c @@ -2830,7 +2830,7 @@ process_resp_ies: continue; owe_dh = data; - owe_dh_len = len; + owe_dh_len = ie_tlv_iter_get_length(&iter); break; -- 2.31.1