diff --git a/[refs] b/[refs]
index b78184d5cd06..1f1ca20925d8 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 77e1251a7cc64c1e483a31c41c139fdf8121e75e
+refs/heads/master: 8d8fe198c6a756ae96617548af4776e7a86c0d3e
diff --git a/trunk/drivers/net/wimax/i2400m/fw.c b/trunk/drivers/net/wimax/i2400m/fw.c
index 0018cdbd0156..92d4d605dc2d 100644
--- a/trunk/drivers/net/wimax/i2400m/fw.c
+++ b/trunk/drivers/net/wimax/i2400m/fw.c
@@ -533,6 +533,10 @@ int i2400m_dnload_finalize(struct i2400m *i2400m,
 		struct i2400m_bootrom_header jump_ack;
 		d_printf(1, dev, "unsecure boot, jumping to 0x%08x\n",
 			le32_to_cpu(cmd->target_addr));
+		cmd_buf = i2400m->bm_cmd_buf;
+		memcpy(&cmd_buf->cmd, cmd, sizeof(*cmd));
+		cmd = &cmd_buf->cmd;
+		/* now cmd points to the actual bootrom_header in cmd_buf */
 		i2400m_brh_set_opcode(cmd, I2400M_BRH_JUMP);
 		cmd->data_size = 0;
 		ret = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd),