diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index e40f6ed65e6a..7166c0606527 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -2244,6 +2244,9 @@ recv_end:
 		else
 			err = process_rx_list(ctx, msg, &control, 0,
 					      async_copy_bytes, is_peek, NULL);
+
+		/* we could have copied less than we wanted, and possibly nothing */
+		decrypted += max(err, 0) - async_copy_bytes;
 	}
 
 	copied += decrypted;