Index: kernel26/drivers/char/n_tihtc.c
===================================================================
--- kernel26.orig/drivers/char/n_tihtc.c	2008-03-01 13:29:29.000000000 +0100
+++ kernel26/drivers/char/n_tihtc.c	2008-03-01 13:29:31.000000000 +0100
@@ -403,7 +403,7 @@
 
 	count = min(rx->count, (int)nr);
 	/* Copy the data to the caller's buffer */
-	if (copy_to_user(buf, rx->buf, rx->count))
+	if (copy_to_user(buf, rx->buf, count))
 		ret = -EFAULT;
 	else
 		ret = count;