diff --git a/toolchain/xpcg/backend/c-mpc/backend.c b/toolchain/xpcg/backend/c-mpc/backend.c
index a245f54..25e0248 100644
--- a/toolchain/xpcg/backend/c-mpc/backend.c
+++ b/toolchain/xpcg/backend/c-mpc/backend.c
@@ -542,6 +542,11 @@ static int emit_interface_msg_function_send_impl(
 			emit(ctx, ": KERN_HANDLE_INVALID;\n");
 			break;
 		case TYPE_BUFFER:
+			emit(ctx,
+			     "*out_%s_len = msg_data.msg_response.%s_len;\n",
+			     param->p_name,
+			     param->p_name);
+			break;
 		case TYPE_STRING:
 			break;
 		default:
@@ -627,13 +632,17 @@ static int emit_interface_msg_function_send(
 			break;
 		case TYPE_STRING:
 			emit(ctx,
-			     "char *out_%s,\nsize_t out_%s_max",
+			     "char *out_%s,\nsize_t out_%s_max,\nsize_t "
+			     "*out_%s_len",
+			     param->p_name,
 			     param->p_name,
 			     param->p_name);
 			break;
 		case TYPE_BUFFER:
 			emit(ctx,
-			     "void *out_%s,\nsize_t out_%s_max",
+			     "void *out_%s,\nsize_t out_%s_max,\nsize_t "
+			     "*out_%s_len",
+			     param->p_name,
 			     param->p_name,
 			     param->p_name);
 			break;
@@ -679,7 +688,7 @@ static int emit_interface_dispatcher_impl_msg(
 	     msg->msg_name);
 	emit(ctx,
 	     "status = xpc_msg_read(msg, 0, &" MSG_STRUCT_NAME
-	     ", sizeof " MSG_STRUCT_NAME ");\n");
+	     ", sizeof " MSG_STRUCT_NAME ", NULL);\n");
 
 	fx_queue_entry *entry = fx_queue_first(&msg->msg_params);
 	while (entry) {
@@ -836,6 +845,13 @@ static int emit_interface_dispatcher_impl_msg(
 			     handle_index);
 			handle_index++;
 			break;
+		case TYPE_BUFFER:
+			emit(ctx,
+			     MSG_STRUCT_NAME
+			     ".msg_response.%s_len = xpc_buffer_length(&%s);\n",
+			     param->p_name,
+			     param->p_name);
+			break;
 		default:
 			break;
 		}