diff --git a/src/add-ons/kernel/drivers/network/ether/usb_rndis/RNDISDevice.cpp b/src/add-ons/kernel/drivers/network/ether/usb_rndis/RNDISDevice.cpp
index b23b5ea6cb..1b17befba3 100644
--- a/src/add-ons/kernel/drivers/network/ether/usb_rndis/RNDISDevice.cpp
+++ b/src/add-ons/kernel/drivers/network/ether/usb_rndis/RNDISDevice.cpp
@@ -289,8 +289,13 @@ RNDISDevice::Read(uint8 *buffer, size_t *numBytes)
 			fActualLengthRead);
 	}
 
+	if (fReadHeader[2] + fReadHeader[3] > fReadHeader[1]) {
+		TRACE_ALWAYS("Received frame data goes past end of frame: %d + %d > %d", fReadHeader[2],
+			fReadHeader[3], fReadHeader[1]);
+	}
+
 	if (fReadHeader[4] != 0 || fReadHeader[5] != 0 || fReadHeader[6] != 0) {
-		TRACE_ALWAYS("Received frame has out of bound data: off %08" B_PRIx32 " len %08" B_PRIx32
+		TRACE_ALWAYS("Received frame has out of band data: off %08" B_PRIx32 " len %08" B_PRIx32
 			" count %08" B_PRIx32 "\n", fReadHeader[4], fReadHeader[5], fReadHeader[6]);
 	}
 
@@ -304,7 +309,8 @@ RNDISDevice::Read(uint8 *buffer, size_t *numBytes)
 	}
 
 	*numBytes = fReadHeader[3];
-	memcpy(buffer, fReadHeader + 11, fReadHeader[3]);
+	int offset = fReadHeader[2] + 2 * sizeof(uint32);
+	memcpy(buffer, (uint8*)fReadHeader + offset, fReadHeader[3]);
 
 	TRACE("Received data packet len %08" B_PRIx32 " data [off %08" B_PRIx32 " len %08" B_PRIx32 "]\n",
 		fReadHeader[1], fReadHeader[2], fReadHeader[3]);