diff --git a/sys/dev/iwi/if_iwi.c b/sys/dev/iwi/if_iwi.c
index 6615e154ef6..be302b43792 100644
--- a/sys/dev/iwi/if_iwi.c
+++ b/sys/dev/iwi/if_iwi.c
@@ -2276,7 +2276,7 @@ iwi_set_chan(struct iwi_softc *sc, struct ieee80211_channel *chan)
 	struct iwi_scan scan;
 
 	memset(&scan, 0, sizeof scan);
-	memset(scan.type, 26, IWI_SCAN_TYPE_PASSIVE);
+	memset(scan.type, IWI_SCAN_TYPE_PASSIVE, sizeof scan.type);
 	scan.passive = htole16(2000);
 	scan.channels[0] = 1 |
 	    (IEEE80211_IS_CHAN_5GHZ(chan) ? IWI_CHAN_5GHZ : IWI_CHAN_2GHZ);
@@ -2298,10 +2298,10 @@ iwi_scan(struct iwi_softc *sc)
 
 	if (ic->ic_des_esslen != 0) {
 		scan.bdirected = htole16(sc->dwelltime);
-		memset(scan.type, 26, IWI_SCAN_TYPE_BDIRECTED);
+		memset(scan.type, IWI_SCAN_TYPE_BDIRECTED, sizeof scan.type);
 	} else {
 		scan.broadcast = htole16(sc->dwelltime);
-		memset(scan.type, 26, IWI_SCAN_TYPE_BROADCAST);
+		memset(scan.type, IWI_SCAN_TYPE_BROADCAST, sizeof scan.type);
 	}
 
 	p = scan.channels;