diff --git a/emulator/btdev.c b/emulator/btdev.c
index cf5c36b..7bb4067 100644
--- a/emulator/btdev.c
+++ b/emulator/btdev.c
@@ -7466,7 +7466,7 @@ void btdev_get_mtu(struct btdev *btdev, uint16_t *acl, uint16_t *sco,
 	if (acl)
 		*acl = btdev->acl_mtu;
 	if (sco)
-		*acl = btdev->sco_mtu;
+		*sco = btdev->sco_mtu;
 	if (iso)
 		*iso = btdev->iso_mtu;
 }
diff --git a/emulator/bthost.c b/emulator/bthost.c
index 214583c..f53b438 100644
--- a/emulator/bthost.c
+++ b/emulator/bthost.c
@@ -688,7 +688,7 @@ static void send_iov(struct bthost *bthost, uint16_t handle, uint16_t cid,
 
 	/* Fragment to ACL MTU */
 
-	payload_mtu = bthost->acl_mtu - pdu[0].iov_len - pdu[1].iov_len;
+	payload_mtu = bthost->acl_mtu - sizeof(pkt) - sizeof(acl_hdr);
 
 	flag = 0x00;
 	do {