Index: hw/pflash_cfi02.c
===================================================================
RCS file: /sources/qemu/qemu/hw/pflash_cfi02.c,v
retrieving revision 1.3
diff -u -5 -p -r1.3 pflash_cfi02.c
--- hw/pflash_cfi02.c	6 Aug 2006 21:13:56 -0000	1.3
+++ hw/pflash_cfi02.c	12 Aug 2006 05:58:16 -0000
@@ -602,11 +602,11 @@ pflash_t *pflash_register (target_ulong 
     /* Max timeout for block erase */
     pfl->cfi_table[0x25] = 0x0A;
     /* Max timeout for chip erase */
     pfl->cfi_table[0x26] = 0x0D;
     /* Device size */
-    pfl->cfi_table[0x27] = ctz32(total_len) + 1;
+    pfl->cfi_table[0x27] = ctz32(total_len);
     /* Flash device interface (8 & 16 bits) */
     pfl->cfi_table[0x28] = 0x02;
     pfl->cfi_table[0x29] = 0x00;
     /* Max number of bytes in multi-bytes write */
     pfl->cfi_table[0x2A] = 0x05;