diff --git a/src/core/hle/service/ac/ac.cpp b/src/core/hle/service/ac/ac.cpp
index b465d4ad8..825a896ba 100644
--- a/src/core/hle/service/ac/ac.cpp
+++ b/src/core/hle/service/ac/ac.cpp
@@ -207,10 +207,10 @@ void Module::Interface::ScanAPs(Kernel::HLERequestContext& ctx) {
     // of cmd_buff
     VAddr cmd_addr = thread->GetCommandBufferAddress();
     VAddr buffer_vaddr = cmd_addr + 0x100;
-    u32* buffer_info = static_cast<u32*>(memory.GetPointer(buffer_vaddr));
+    u8* buffer_info = memory.GetPointer(buffer_vaddr);
     const u32 descr = buffer_info[0];
     ASSERT(descr == ((size << 14) | 2));    // preliminary check
-    const VAddr output_buffer = buffer_info[1]; // address to output buffer
+    const VAddr output_buffer = buffer_info[4]; // address to output buffer
 
     Network::MacAddress mac = Network::BroadcastMac;
     u32 mac1 = (mac[0] << 8) | (mac[1]);