diff --git a/mt76_connac_mcu.c b/mt76_connac_mcu.c
index fa08e952..16db0f20 100644
--- a/mt76_connac_mcu.c
+++ b/mt76_connac_mcu.c
@@ -1740,8 +1740,8 @@ int mt76_connac_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
 		if (!sreq->ssids[i].ssid_len)
 			continue;
 
-		req->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
-		memcpy(req->ssids[i].ssid, sreq->ssids[i].ssid,
+		req->ssids[n_ssids].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
+		memcpy(req->ssids[n_ssids].ssid, sreq->ssids[i].ssid,
 		       sreq->ssids[i].ssid_len);
 		n_ssids++;
 	}
diff --git a/mt7925/mcu.c b/mt7925/mcu.c
index 0375b390..b6365bf9 100644
--- a/mt7925/mcu.c
+++ b/mt7925/mcu.c
@@ -2871,9 +2871,9 @@ int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
 		if (i > MT7925_RNR_SCAN_MAX_BSSIDS)
 			break;
 
-		short_ssid[i] = ~crc32_le(~0, sreq->ssids[i].ssid,
+		short_ssid[n_ssids] = ~crc32_le(~0, sreq->ssids[i].ssid,
 					  sreq->ssids[i].ssid_len);
-		ssid->ssids[i].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
+		ssid->ssids[n_ssids].ssid_len = cpu_to_le32(sreq->ssids[i].ssid_len);
 		memcpy(ssid->ssids[i].ssid, sreq->ssids[i].ssid,
 		       sreq->ssids[i].ssid_len);
 		n_ssids++;