diff --git a/include/common/buffer.h b/include/common/buffer.h
index e49316efe..ae4e6804e 100644
--- a/include/common/buffer.h
+++ b/include/common/buffer.h
@@ -52,6 +52,7 @@ void buffer_bounce_realign(struct buffer *buf);
  * pointer. It is written so that it is optimal when <ofs> is a const. It is
  * written as a macro instead of an inline function so that the compiler knows
  * when it can optimize out the sign test on <ofs> when passed an unsigned int.
+ * Note that callers MUST cast <ofs> to int if they expect negative values.
  */
 #define b_ptr(b, ofs) \
 	({            \
diff --git a/src/backend.c b/src/backend.c
index 29d814599..7ef0a4922 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -343,7 +343,7 @@ struct server *get_server_hh(struct session *s)
 	ctx.idx = 0;
 
 	/* if the message is chunked, we skip the chunk size, but use the value as len */
-	http_find_header2(px->hh_name, plen, b_ptr(&s->req->buf, s->req->buf.o), &txn->hdr_idx, &ctx);
+	http_find_header2(px->hh_name, plen, b_ptr(&s->req->buf, (int)-s->req->buf.o), &txn->hdr_idx, &ctx);
 
 	/* if the header is not found or empty, let's fallback to round robin */
 	if (!ctx.idx || !ctx.vlen)