diff --git a/libwifi/modules/broadcom/wlctrl.c b/libwifi/modules/broadcom/wlctrl.c
index 3a5735eb2a2672e0f7e4c5690039d8cc5b8316f5..9e2afe934c329966ac54cdf545006d5205a29f57 100644
--- a/libwifi/modules/broadcom/wlctrl.c
+++ b/libwifi/modules/broadcom/wlctrl.c
@@ -2129,7 +2129,7 @@ int bcmwl_iface_ap_info(const char *name, struct wifi_ap *ap)
 	if (ie_ptr) {
 		ap->bss.caps.valid |= WIFI_CAP_HE_VALID;
 		memcpy(&ap->bss.caps.he, &ie_ptr[3], min(ie_ptr[1], sizeof(struct wifi_caps_he)));
-		wifi_cap_set_from_ie(ap->bss.cbitmap, ie_ptr, ie_ptr[1] + 3);
+		wifi_cap_set_from_ie(ap->bss.cbitmap, ie_ptr, ie_ptr[1] + 2);
 	}
 
 	/* WMM stats */
diff --git a/libwifi/util.c b/libwifi/util.c
index 52700705f2845589a0c92c41cfddc174399981f0..19ac137a47e59141df6eeb93ff5989fa6be54049 100644
--- a/libwifi/util.c
+++ b/libwifi/util.c
@@ -512,10 +512,7 @@ void wifi_cap_set_from_ie(uint8_t *bitmap, uint8_t *ie, size_t len)
 		return;
 	}
 
-	if (ie[0] != IE_EXT && ie[1] != len - 2)
-		return;   /* bad request */
-
-	if (ie[0] == IE_EXT && ie[1] != len - 3)
+	if (ie[1] != len - 2)
 		return;   /* bad request */
 
 	eid = ie[0];