diff --git a/tests/api/test_pkcs7.c b/tests/api/test_pkcs7.c
index b86262f112..810573a6d1 100644
--- a/tests/api/test_pkcs7.c
+++ b/tests/api/test_pkcs7.c
@@ -2895,8 +2895,9 @@ int test_wc_PKCS7_DecodeAuthEnvelopedData_truncated(void)
         pkcs7->contentOID = DATA;
         pkcs7->encryptOID = AES128GCMb;
     }
+    /* >32 so the encSz-32 / encSz-1 truncations below can't underflow */
     ExpectIntGT(encSz = wc_PKCS7_EncodeAuthEnvelopedData(pkcs7, enveloped,
-        sizeof(enveloped)), 0);
+        sizeof(enveloped)), 32);
     wc_PKCS7_Free(pkcs7);
     pkcs7 = NULL;
 
diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index bb42fca82d..5ab3c54e34 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -14968,11 +14968,11 @@ int wc_PKCS7_DecodeAuthEnvelopedData(wc_PKCS7* pkcs7, byte* in,
                 }
             }
 
+        #ifdef NO_PKCS7_STREAM
             if (ret == 0 && encryptedContentSz > (int)(pkiMsgSz - idx)) {
-            #ifdef NO_PKCS7_STREAM
                 ret = BUFFER_E;
-            #endif
             }
+        #endif
 
             if (ret < 0)
                 break;