diff --git a/test-tool/1020_bufferoffset_invalid.c b/test-tool/1020_bufferoffset_invalid.c
index 826d392..ce1a1e9 100644
--- a/test-tool/1020_bufferoffset_invalid.c
+++ b/test-tool/1020_bufferoffset_invalid.c
@@ -73,6 +73,7 @@ int T1020_bufferoffset_invalid(const char *initiator, const char *url, int data_
 		printf("Test sending commands with invalid bufferoffset values.\n");
 		printf("We negotiate both DataPDUInOrder and DataSequenceInOrder so BufferOffset must be in sequence both within and across multiple sequences\n");
 		printf("1, Test that BufferOffset==1M too high is an error\n");
+		printf("2, Test that BufferOffset==-512 is an error\n");
 		printf("\n");
 		return 0;
 	}
@@ -152,7 +153,51 @@ int T1020_bufferoffset_invalid(const char *initiator, const char *url, int data_
 	printf("[OK]\n");
 
 test2:
+	/* in case the previous test failed the session */
+	iscsi_set_noautoreconnect(iscsi, 0);
+	iscsi->use_immediate_data = ISCSI_IMMEDIATE_DATA_NO;
+	iscsi->target_max_recv_data_segment_length = 512;
+
+	printf("Write 2 DATA-IN with BUFFEROFFSET==-512 ... ");
+	/* we dont want autoreconnect since some targets will drop the
+	 * on this condition.
+	 */
+	iscsi_set_noautoreconnect(iscsi, 1);
+
+	task = iscsi_write10_task(iscsi, lun, 0, data, 2 * block_size, block_size,
+				0, 0, 0, 0, 0,
+				test_cb, &test_state);
+	if (task == NULL) {
+	        printf("[FAILED]\n");
+		printf("Failed to send WRITE10 command: %s\n", iscsi_get_error(iscsi));
+		ret++;
+		goto test3;
+	}
+	change_bufferoffset = 2;
+	test_state.task     = task;
+	test_state.finished = 0;
+	test_state.status   = 0;
+	wait_until_test_finished(iscsi, &test_state);
+	change_bufferoffset = 0;
+	if (task->status == SCSI_STATUS_GOOD) {
+	        printf("[FAILED]\n");
+		printf("WRITE10 command successful. Should have failed with error\n");
+		ret++;
+		scsi_free_scsi_task(task);
+		goto test3;
+	}
+	scsi_free_scsi_task(task);
+	printf("[OK]\n");
+
+
+test3:
+	/* in case the previous test failed the session */
+	iscsi_set_noautoreconnect(iscsi, 0);
+	iscsi->use_immediate_data = ISCSI_IMMEDIATE_DATA_NO;
+	iscsi->target_max_recv_data_segment_length = 512;
 
 finished:
+	local_iscsi_queue_pdu = NULL;
+	iscsi_destroy_context(iscsi);
 	return ret;
 }