diff --git a/CHANGES b/CHANGES
index 7a91b5a2af..5fb07156e7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4296.	[bug]		TCP packet sizes were calculated incorrectly in the
+			stats channel; they could be counted in the wrong
+			histogram bucket. [RT #40587]
+
 4295.	[bug]		An unchecked result in dns_message_pseudosectiontotext()
 			could allow incorrect text formatting of EDNS EXPIRE
 			options. [RT #41437]
diff --git a/bin/named/client.c b/bin/named/client.c
index 242e4a30fc..21dabd2d28 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -1166,7 +1166,8 @@ client_send(ns_client_t *client) {
 		isc_buffer_putuint16(&tcpbuffer, (isc_uint16_t) r.length);
 		isc_buffer_add(&tcpbuffer, r.length);
 
-		respsize = isc_buffer_usedlength(&tcpbuffer);
+		/* don't count the 2-octet length header */
+		respsize = isc_buffer_usedlength(&tcpbuffer) - 2;
 		result = client_sendpkg(client, &tcpbuffer);
 
 #ifdef HAVE_DNSTAP
@@ -2145,6 +2146,9 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	}
 
 	reqsize = isc_buffer_usedlength(buffer);
+	/* don't count the length header */
+	if (TCP_CLIENT(client))
+		reqsize -= 2;
 
 	if (exit_check(client))
 		goto cleanup;
diff --git a/bin/tests/system/statschannel/traffic.expect.5 b/bin/tests/system/statschannel/traffic.expect.5
index d29db3496a..15911b1625 100644
--- a/bin/tests/system/statschannel/traffic.expect.5
+++ b/bin/tests/system/statschannel/traffic.expect.5
@@ -1,6 +1,6 @@
 tcp request-size 16-31: 1
 tcp request-size 48-63: 1
-tcp response-size 128-143: 1
+tcp response-size 112-127: 1
 tcp response-size 64-79: 1
 udp request-size 48-63: 2
 udp response-size 112-127: 1
diff --git a/bin/tests/system/statschannel/traffic.expect.6 b/bin/tests/system/statschannel/traffic.expect.6
index d75b3c1ef4..73fc8f1831 100644
--- a/bin/tests/system/statschannel/traffic.expect.6
+++ b/bin/tests/system/statschannel/traffic.expect.6
@@ -1,6 +1,6 @@
 tcp request-size 16-31: 1
 tcp request-size 48-63: 2
-tcp response-size 128-143: 1
+tcp response-size 112-127: 1
 tcp response-size 64-79: 1
 tcp response-size 848-863: 1
 udp request-size 48-63: 2