diff --git a/src/common/sae.c b/src/common/sae.c
index f0d4c228c..0f53c4df5 100644
--- a/src/common/sae.c
+++ b/src/common/sae.c
@@ -2268,10 +2268,10 @@ int sae_write_confirm(struct sae_data *sae, struct wpabuf *buf)
 	hash_len = sae->tmp->kck_len;
 
 	/* Send-Confirm */
-	sc = wpabuf_put(buf, 0);
-	wpabuf_put_le16(buf, sae->send_confirm);
 	if (sae->send_confirm < 0xffff)
 		sae->send_confirm++;
+	sc = wpabuf_put(buf, 0);
+	wpabuf_put_le16(buf, sae->send_confirm);
 
 	if (sae->tmp->ec)
 		res = sae_cn_confirm_ecc(sae, sc, sae->tmp->own_commit_scalar,