diff --git a/src/event/ngx_event_quic_protection.c b/src/event/ngx_event_quic_protection.c
index fd11e591e..261f02d7f 100644
--- a/src/event/ngx_event_quic_protection.c
+++ b/src/event/ngx_event_quic_protection.c
@@ -1058,13 +1058,12 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, ngx_ssl_conn_t *ssl_conn,
     /* packet protection */
 
     in.data = p;
+    in.len = pkt->len - pnl;
 
     if (ngx_quic_long_pkt(pkt->flags)) {
-        in.len = pkt->len - pnl;
         badflags = clearflags & NGX_QUIC_PKT_LONG_RESERVED_BIT;
 
     } else {
-        in.len = pkt->data + pkt->len - p;
         badflags = clearflags & NGX_QUIC_PKT_SHORT_RESERVED_BIT;
     }
 
diff --git a/src/event/ngx_event_quic_transport.c b/src/event/ngx_event_quic_transport.c
index 36e987f92..1d270a2f2 100644
--- a/src/event/ngx_event_quic_transport.c
+++ b/src/event/ngx_event_quic_transport.c
@@ -511,6 +511,7 @@ ngx_quic_parse_short_header(ngx_quic_header_t *pkt, ngx_str_t *dcid)
     }
 
     pkt->raw->pos = p;
+    pkt->len = end - p;
 
     return NGX_OK;
 }