diff --git a/scapy/contrib/automotive/bmw/hsfz.py b/scapy/contrib/automotive/bmw/hsfz.py
index 9758c078656..3316d7d136f 100644
--- a/scapy/contrib/automotive/bmw/hsfz.py
+++ b/scapy/contrib/automotive/bmw/hsfz.py
@@ -59,23 +59,31 @@ class HSFZ(Packet):
         IntField('length', None),
         ShortEnumField('control', 1, control_words),
         ConditionalField(
-            XByteField('source', 0), lambda p: p._hasaddrs()),
+            XByteField('source', 0), lambda p: p._has_srctgt_addrs()),
         ConditionalField(
-            XByteField('target', 0), lambda p: p._hasaddrs()),
+            XByteField('target', 0), lambda p: p._has_srctgt_addrs()),
+        ConditionalField(
+            XByteField('expected', 0), lambda p: p._has_exprecv_addrs()),
+        ConditionalField(
+            XByteField('received', 0), lambda p: p._has_exprecv_addrs()),
         ConditionalField(
             StrFixedLenField("identification_string",
                              None, None, lambda p: p.length),
             lambda p: p._hasidstring())
     ]
 
-    def _hasaddrs(self):
+    def _has_srctgt_addrs(self):
         # type: () -> bool
         # Address present in diagnostic_req_res, acknowledge_transfer,
-        # two byte length alive_check and incorrect_tester_address frames.
+        # and two byte length alive_check frames.
         return self.control == 0x01 or \
             self.control == 0x02 or \
-            (self.control == 0x12 and self.length == 2) or \
-            self.control == 0x40
+            (self.control == 0x12 and self.length == 2)
+
+    def _has_exprecv_addrs(self):
+        # type: () -> bool
+        # Address present in incorrect_tester_address frames.
+        return self.control == 0x40
 
     def _hasidstring(self):
         # type: () -> bool
diff --git a/test/contrib/automotive/bmw/hsfz.uts b/test/contrib/automotive/bmw/hsfz.uts
index c47edc4bdf5..9f199b38012 100644
--- a/test/contrib/automotive/bmw/hsfz.uts
+++ b/test/contrib/automotive/bmw/hsfz.uts
@@ -128,8 +128,8 @@ assert pkt.target == 0xf4
 pkt = HSFZ(bytes.fromhex("000000020040fff4"))
 assert pkt.length == 2
 assert pkt.control == 0x40
-assert pkt.source == 0xff
-assert pkt.target == 0xf4
+assert pkt.expected == 0xff
+assert pkt.received == 0xf4
 
 
 = Test HSFZSocket