diff --git a/uefi/CHANGELOG.md b/uefi/CHANGELOG.md
index 76f6cf61d..952bad60c 100644
--- a/uefi/CHANGELOG.md
+++ b/uefi/CHANGELOG.md
@@ -7,6 +7,9 @@
 - `boot::memory_map()` will never return `Status::BUFFER_TOO_SMALL` from now on,
   as this is considered a hard internal error where users can't do anything
   about it anyway. It will panic instead.
+- `SimpleNetwork::transmit` now passes the correct buffer size argument.
+  Previously it incorrectly added the header size to the buffer length, which
+  could cause the firmware to read past the end of the buffer.
 
 
 # uefi - 0.34.1 (2025-02-07)
diff --git a/uefi/src/proto/network/snp.rs b/uefi/src/proto/network/snp.rs
index f1dbe3aab..d9563a832 100644
--- a/uefi/src/proto/network/snp.rs
+++ b/uefi/src/proto/network/snp.rs
@@ -225,7 +225,7 @@ impl SimpleNetwork {
         (self.transmit)(
             self,
             header_size,
-            buffer.len() + header_size,
+            buffer.len(),
             buffer.as_ptr().cast(),
             src_addr.as_ref(),
             dest_addr.as_ref(),