diff --git a/internet/stack-ethernet.go b/internet/stack-ethernet.go
index fd1edcc..499c641 100644
--- a/internet/stack-ethernet.go
+++ b/internet/stack-ethernet.go
@@ -108,8 +108,9 @@ func (ls *StackEthernet) Encapsulate(carrierData []byte, offsetToIP, offsetToFra
 	// For IP: offsetToIP=14, offsetToFrame=14
 	// For ARP: offsetToIP=-1, offsetToFrame=14 (but ARP ignores offsetToIP)
 	// Clip carrierData to MTU to prevent writes beyond MTU limit.
+	offsetToFrame += 14
 	mtuLimit := offsetToFrame + int(mtu)
-	h, n, err = ls.handlers.encapsulateAny(carrierData[:mtuLimit], offsetToFrame+14, offsetToFrame+14)
+	h, n, err = ls.handlers.encapsulateAny(carrierData[:mtuLimit], offsetToFrame, offsetToFrame)
 	if n == 0 {
 		return n, err
 	}
diff --git a/tcp/handler.go b/tcp/handler.go
index 33ffe13..ac9f2d4 100644
--- a/tcp/handler.go
+++ b/tcp/handler.go
@@ -244,11 +244,12 @@ func (h *Handler) Send(b []byte) (int, error) {
 		}
 	}
 	offset := uint8(5)
+	mss := uint16(len(b) - sizeHeaderTCP)
 	var segment Segment
 	if h.AwaitingSynSend() {
 		// Handling init syn segment.
 		segment = ClientSynSegment(h.bufTx.iss, Size(h.bufRx.Size()))
-		h.optcodec.PutOption16(b[sizeHeaderTCP:], OptMaxSegmentSize, uint16(len(b)))
+		h.optcodec.PutOption16(b[sizeHeaderTCP:], OptMaxSegmentSize, mss)
 		offset++
 	} else {
 		var ok bool
@@ -266,7 +267,7 @@ func (h *Handler) Send(b []byte) (int, error) {
 				panic("expected n == available")
 			}
 		} else if segment.Flags == synack {
-			h.optcodec.PutOption16(b[sizeHeaderTCP:], OptMaxSegmentSize, uint16(len(b)))
+			h.optcodec.PutOption16(b[sizeHeaderTCP:], OptMaxSegmentSize, mss)
 			offset++
 		}
 	}
diff --git a/x/xnet/xnet_concurrent_test.go b/x/xnet/xnet_concurrent_test.go
index 1f5e941..ca5e64f 100644
--- a/x/xnet/xnet_concurrent_test.go
+++ b/x/xnet/xnet_concurrent_test.go
@@ -140,7 +140,8 @@ func TestTCPListener_ConcurrentEcho(t *testing.T) {
 
 func kernelLoop(ctx context.Context, server *StackAsync, clients []StackAsync) {
 	const MTU = 1500
-	buf := make([]byte, MTU)
+	const carrierDataSize = MTU + 14
+	buf := make([]byte, carrierDataSize)
 	rng := rand.New(rand.NewSource(1)) // Seed 1 for deterministic but randomized order
 	order := make([]int, len(clients))
 	for i := range order {
diff --git a/x/xnet/xnet_dns_test.go b/x/xnet/xnet_dns_test.go
index 0822366..7d1f739 100644
--- a/x/xnet/xnet_dns_test.go
+++ b/x/xnet/xnet_dns_test.go
@@ -47,7 +47,8 @@ func TestDNS_QueryReceivesAnswer(t *testing.T) {
 	}
 
 	// Client sends DNS query.
-	var buf [MTU]byte
+	const carrierDataSize = MTU + 14
+	var buf [carrierDataSize]byte
 	n, err := client.Encapsulate(buf[:], -1, 0)
 	if err != nil {
 		t.Fatal("client Encapsulate failed:", err)
diff --git a/x/xnet/xnet_test.go b/x/xnet/xnet_test.go
index 96abb10..a5625cf 100644
--- a/x/xnet/xnet_test.go
+++ b/x/xnet/xnet_test.go
@@ -217,9 +217,10 @@ func newTCPStacks(t *testing.T, randSeed int64, mtu int) (s1, s2 *StackAsync, c1
 }
 
 func testerFrom(t *testing.T, mtu int) *tester {
+	carrierDataSize := mtu + 14
 	return &tester{
 		t:   t,
-		buf: make([]byte, mtu),
+		buf: make([]byte, carrierDataSize),
 	}
 }