diff --git a/test-tool/test_iscsi_cmdsn_toolow.c b/test-tool/test_iscsi_cmdsn_toolow.c
index eb50524..e0cbd74 100644
--- a/test-tool/test_iscsi_cmdsn_toolow.c
+++ b/test-tool/test_iscsi_cmdsn_toolow.c
@@ -31,7 +31,7 @@ static int my_iscsi_queue_pdu(struct iscsi_context *iscsi, struct iscsi_pdu *pdu
 	switch (change_cmdsn) {
 	case 1:
 		/* change the cmdsn so it becomes too big */
-		scsi_set_uint32(&pdu->outdata.data[24], iscsi->expcmdsn + 1);
+		scsi_set_uint32(&pdu->outdata.data[24], iscsi->expcmdsn - 1);
 		/* fudge the cmdsn value back to where it should be if this
 		 * pdu is ignored.
 		 */