diff --git a/wpa_supplicant/robust_av.c b/wpa_supplicant/robust_av.c
index 31315517a..4ac1a2bb9 100644
--- a/wpa_supplicant/robust_av.c
+++ b/wpa_supplicant/robust_av.c
@@ -94,7 +94,7 @@ int wpas_send_mscs_req(struct wpa_supplicant *wpa_s)
 	/* MSCS descriptor element */
 	wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, buf);
 
-	wpa_hexdump_buf(MSG_MSGDUMP, "MSCS Request", wpabuf_head(buf));
+	wpa_hexdump_buf(MSG_MSGDUMP, "MSCS Request", buf);
 	ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 				  wpa_s->own_addr, wpa_s->bssid,
 				  wpabuf_head(buf), wpabuf_len(buf), 0);
diff --git a/wpa_supplicant/sme.c b/wpa_supplicant/sme.c
index 592c742fa..2faaff930 100644
--- a/wpa_supplicant/sme.c
+++ b/wpa_supplicant/sme.c
@@ -1905,8 +1905,7 @@ pfs_fail:
 		max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
 		wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
 		if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
-			wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE",
-					wpabuf_head(mscs_ie));
+			wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
 			mscs_ie_len = wpabuf_len(mscs_ie);
 			os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
 				  wpabuf_head(mscs_ie), mscs_ie_len);
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 3d2c0a985..39e92fb68 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -3214,8 +3214,7 @@ pfs_fail:
 
 		wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
 		if ((wpa_ie_len + wpabuf_len(mscs_ie)) <= max_wpa_ie_len) {
-			wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE",
-					wpabuf_head(mscs_ie));
+			wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
 			mscs_ie_len = wpabuf_len(mscs_ie);
 			os_memcpy(wpa_ie + wpa_ie_len, wpabuf_head(mscs_ie),
 				  mscs_ie_len);