diff --git a/mcu.c b/mcu.c
index 946694af..3f94c372 100644
--- a/mcu.c
+++ b/mcu.c
@@ -112,7 +112,7 @@ int __mt76_mcu_send_firmware(struct mt76_dev *dev, int cmd, const void *data,
 	int err, cur_len;
 
 	while (len > 0) {
-		cur_len = min_t(int, max_len - dev->mcu_ops->headroom, len);
+		cur_len = min_t(int, max_len, len);
 
 		err = mt76_mcu_send_msg(dev, cmd, data, cur_len, false);
 		if (err)
diff --git a/mt76.h b/mt76.h
index 59ca90d4..520fd162 100644
--- a/mt76.h
+++ b/mt76.h
@@ -1264,7 +1264,9 @@ static inline int
 mt76_mcu_send_firmware(struct mt76_dev *dev, int cmd, const void *data,
 		       int len)
 {
-	return __mt76_mcu_send_firmware(dev, cmd, data, len, 4096);
+	int max_len = 4096 - dev->mcu_ops->headroom;
+
+	return __mt76_mcu_send_firmware(dev, cmd, data, len, max_len);
 }
 
 static inline int
diff --git a/mt7915/mcu.c b/mt7915/mcu.c
index e524ab6b..8b4270de 100644
--- a/mt7915/mcu.c
+++ b/mt7915/mcu.c
@@ -2649,8 +2649,8 @@ static int mt7915_load_patch(struct mt7915_dev *dev)
 			goto out;
 		}
 
-		ret = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
-					     dl, len);
+		ret = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
+					       dl, len, 4096);
 		if (ret) {
 			dev_err(dev->mt76.dev, "Failed to send patch\n");
 			goto out;
@@ -2718,8 +2718,8 @@ mt7915_mcu_send_ram_firmware(struct mt7915_dev *dev,
 			return err;
 		}
 
-		err = mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
-					     data + offset, len);
+		err = __mt76_mcu_send_firmware(&dev->mt76, MCU_CMD(FW_SCATTER),
+					       data + offset, len, 4096);
 		if (err) {
 			dev_err(dev->mt76.dev, "Failed to send firmware.\n");
 			return err;