diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index 436870b518..1dca728a07 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -3377,7 +3377,7 @@ int mbedtls_ssl_prepare_handshake_record(mbedtls_ssl_context *ssl)
 #else
         size_t const in_buf_len = MBEDTLS_SSL_IN_BUFFER_LEN;
 #endif
-        if (payload_end + ssl->badmac_seen_or_in_hsfraglen > ssl->in_buf + in_buf_len) {
+        if (payload_end + ssl->in_msglen > ssl->in_buf + in_buf_len) {
             MBEDTLS_SSL_DEBUG_MSG(1,
                                   ("Shouldn't happen: no room to move handshake fragment %"
                                    MBEDTLS_PRINTF_SIZET " from %p to %p (buf=%p len=%"