diff --git a/nimble/host/src/ble_gap.c b/nimble/host/src/ble_gap.c
index 799b7f613..a9a844dd4 100644
--- a/nimble/host/src/ble_gap.c
+++ b/nimble/host/src/ble_gap.c
@@ -9280,13 +9280,14 @@ ble_gap_end_test_evt(const void *buf, uint8_t len)
 {
     struct ble_gap_event event;
     struct ble_hci_ev_command_complete *cmd_complete = (void *) buf;
-    uint8_t status, *ptr;
+    uint8_t status;
     uint16_t num_pkt;
 
     status = cmd_complete->status;
-    ptr = (uint8_t *)cmd_complete->return_params;
-
-    num_pkt = htole16(*ptr);
+    num_pkt = 0;
+    if (len >= sizeof(*cmd_complete) + sizeof(num_pkt)) {
+        num_pkt = get_le16(cmd_complete->return_params);
+    }
 
     memset(&event, 0, sizeof event);
     event.type = BLE_GAP_EVENT_TEST_UPDATE;