diff --git a/android/avrcp-lib.c b/android/avrcp-lib.c
index e56803f..077343f 100644
--- a/android/avrcp-lib.c
+++ b/android/avrcp-lib.c
@@ -1489,13 +1489,19 @@ done:
 int avrcp_get_player_attribute_text(struct avrcp *session, uint8_t number,
 								uint8_t *attrs)
 {
-	struct iovec iov;
+	struct iovec iov[2];
 
-	iov.iov_base = attrs;
-	iov.iov_len = number;
+	if (!number || number > AVRCP_ATTRIBUTE_LAST)
+		return -EINVAL;
+
+	iov[0].iov_base = &number;
+	iov[0].iov_len = sizeof(number);
+
+	iov[1].iov_base = attrs;
+	iov[1].iov_len = number;
 
 	return avrcp_send_req(session, AVC_CTYPE_STATUS, AVC_SUBUNIT_PANEL,
-				AVRCP_GET_PLAYER_ATTRIBUTE_TEXT, &iov, 1,
+				AVRCP_GET_PLAYER_ATTRIBUTE_TEXT, iov, 2,
 				get_attribute_text_rsp, session);
 }
 
diff --git a/unit/test-avrcp.c b/unit/test-avrcp.c
index 7dff898..ebef162 100644
--- a/unit/test-avrcp.c
+++ b/unit/test-avrcp.c
@@ -730,8 +730,13 @@ static void test_client(gconstpointer data)
 	if (g_str_equal(context->data->test_name, "/TP/PAS/BV-01-C"))
 		avrcp_list_player_attributes(context->session);
 
-	if (g_str_equal(context->data->test_name, "/TP/PAS/BV-03-C"))
-		avrcp_get_player_attribute_text(context->session, 0, NULL);
+	if (g_str_equal(context->data->test_name, "/TP/PAS/BV-03-C")) {
+		uint8_t attrs[2] = { AVRCP_ATTRIBUTE_EQUALIZER,
+						AVRCP_ATTRIBUTE_REPEAT_MODE };
+
+		avrcp_get_player_attribute_text(context->session, sizeof(attrs),
+									attrs);
+	}
 
 	if (g_str_equal(context->data->test_name, "/TP/PAS/BV-09-C")) {
 		uint8_t attrs[2] = { AVRCP_ATTRIBUTE_EQUALIZER,
@@ -1211,7 +1216,9 @@ int main(int argc, char *argv[])
 			raw_pdu(0x00, 0x11, 0x0e, 0x01, 0x48, 0x00,
 				0x00, 0x19, 0x58,
 				AVRCP_GET_PLAYER_ATTRIBUTE_TEXT,
-				0x00, 0x00, 0x00));
+				0x00, 0x00, 0x03, 0x02,
+				AVRCP_ATTRIBUTE_EQUALIZER,
+				AVRCP_ATTRIBUTE_REPEAT_MODE));
 
 	define_test("/TP/PAS/BV-04-C", test_server,
 			raw_pdu(0x00, 0x11, 0x0e, 0x01, 0x48, 0x00,