fill_rx = 1;
 
        while (i != r) {
+               int len;
+
                rxb = rxq->queue[i];
 
                /* If an RXB doesn't have a Rx queue slot associated with it,
                               PCI_DMA_FROMDEVICE);
                pkt = rxb_addr(rxb);
 
-               trace_iwlwifi_dev_rx(priv, pkt,
-                       le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
+               len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+               len += sizeof(u32); /* account for status word */
+               trace_iwlwifi_dev_rx(priv, pkt, len);
 
                /* Reclaim a command buffer only if this packet is a response
                 *   to a (driver-originated) command.
 
                IWL_DEBUG_RX(priv, "r = %d, i = %d\n", r, i);
 
        while (i != r) {
+               int len;
+
                rxb = rxq->queue[i];
 
                /* If an RXB doesn't have a Rx queue slot associated with it,
                               PCI_DMA_FROMDEVICE);
                pkt = rxb_addr(rxb);
 
-               trace_iwlwifi_dev_rx(priv, pkt,
-                       le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
+               len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+               len += sizeof(u32); /* account for status word */
+               trace_iwlwifi_dev_rx(priv, pkt, len);
 
                /* Reclaim a command buffer only if this packet is a response
                 *   to a (driver-originated) command.