diff --git a/dlls/rpcrt4/rpc_message.c b/dlls/rpcrt4/rpc_message.c
index e19735d11f7787de860873a6dbe1caa3d732b61b..ccf33fa4482cc2ac94f7e49c219a3644656ceae4 100644
--- a/dlls/rpcrt4/rpc_message.c
+++ b/dlls/rpcrt4/rpc_message.c
@@ -304,7 +304,7 @@ static RPC_STATUS RPCRT4_SendAuth(RpcConnection *Connection, RpcPktHdr *Header,
     if (hdr_size == Header->common.frag_len)
       goto write;
 
-    memcpy(pkt + hdr_size, buffer_pos, Header->common.frag_len - hdr_size - alen);
+    memcpy(pkt + hdr_size, buffer_pos, Header->common.frag_len - hdr_size - auth_pad_len - alen);
 
     /* add the authorization info */
     if (Connection->AuthInfo && AuthLength)