diff --git a/tests/linux/afp_set_file_info_smoke.c b/tests/linux/afp_set_file_info_smoke.c
index 51b7529..3fb9603 100644
--- a/tests/linux/afp_set_file_info_smoke.c
+++ b/tests/linux/afp_set_file_info_smoke.c
@@ -235,6 +235,14 @@ int main(int argc, char **argv)
     cpu_to_be16(request_mask, request + 5);
     request[7] = (uint8_t)path_len;
     memcpy(request + 8, path, path_len);
+    /*
+     * The server-side AFP request buffer includes the NCP AFP subfunction byte
+     * at offset 0.  This smoke helper passes only the subfunction payload to
+     * NWRequestSimple(), so every server offset after the leading function byte
+     * maps to request_offset - 1 here.  Align once in AFP/server coordinates,
+     * then subtract one; do not align the payload offset again or FinderInfo-only
+     * requests with an even path length get a leading zero byte persisted.
+     */
     afp_data_off = 1 + 8 + path_len;
     if (afp_data_off & 1)
         afp_data_off++;
@@ -243,7 +251,8 @@ int main(int argc, char **argv)
         cpu_to_be16(attr_request, request + data_off);
         data_off += 2;
     }
-    if ((request_mask & AFP_FINDER_INFO_MASK) && (data_off & 1))
+    if ((request_mask & AFP_FINDER_INFO_MASK) && (request_mask & AFP_ATTRIBUTES_MASK) &&
+        ((data_off + 1) & 1))
         data_off++;
     if (request_mask & AFP_FINDER_INFO_MASK) {
         memcpy(request + data_off, finder_info, sizeof(finder_info));