int err, cur_len;
 
        while (len > 0) {
-               cur_len = min_t(int, max_len - dev->mcu_ops->headroom, len);
+               cur_len = min_t(int, max_len, len);
 
                err = mt76_mcu_send_msg(dev, cmd, data, cur_len, false);
                if (err)
 
 mt76_mcu_send_firmware(struct mt76_dev *dev, int cmd, const void *data,
                       int len)
 {
-       return __mt76_mcu_send_firmware(dev, cmd, data, len, 4096);
+       int max_len = 4096 - dev->mcu_ops->headroom;
+
+       return __mt76_mcu_send_firmware(dev, cmd, data, len, max_len);
 }
 
 static inline int
 
                        goto out;
                }
 
-               ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
-                                            dl, len);
+               ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
+                                              dl, len, 4096);
                if (ret) {
                        dev_err(dev->mt76.dev, "Failed to send patch\n");
                        goto out;
                        return err;
                }
 
-               err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
-                                            data + offset, len);
+               err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
+                                              data + offset, len, 4096);
                if (err) {
                        dev_err(dev->mt76.dev, "Failed to send firmware.\n");
                        return err;