diff --git a/SMBLibrary/SMB2/Commands/IOCtlRequest.cs b/SMBLibrary/SMB2/Commands/IOCtlRequest.cs
index c26682a..25d2246 100644
--- a/SMBLibrary/SMB2/Commands/IOCtlRequest.cs
+++ b/SMBLibrary/SMB2/Commands/IOCtlRequest.cs
@@ -68,7 +68,7 @@ namespace SMBLibrary.SMB2
             }
             if (Output.Length > 0)
             {
-                OutputOffset = InputOffset + (uint)Input.Length;
+                OutputOffset = SMB2Header.Length + FixedLength + (uint)Input.Length;
             }
             LittleEndianWriter.WriteUInt16(buffer, offset + 0, StructureSize);
             LittleEndianWriter.WriteUInt16(buffer, offset + 2, Reserved);