diff --git a/usr.sbin/bhyve/pci_emul.c b/usr.sbin/bhyve/pci_emul.c
index 036aaeb5e..22eccc681 100644
--- a/usr.sbin/bhyve/pci_emul.c
+++ b/usr.sbin/bhyve/pci_emul.c
@@ -905,6 +905,13 @@ msicap_cfgwrite(struct pci_devinst *pi, int capoff, int offset,
 	uint16_t msgctrl, rwmask, msgdata, mme;
 	uint32_t addrlo;
 
+	/* Convert a 4-byte write at offset 0 into a 2-byte write at 2 */
+	if (offset == capoff && bytes == 4) {
+		offset += 2;
+		bytes -= 2;
+		val >>= 16;
+	}
+
 	/*
 	 * If guest is writing to the message control register make sure
 	 * we do not overwrite read-only fields.
diff --git a/usr.sbin/bhyve/pci_passthru.c b/usr.sbin/bhyve/pci_passthru.c
index b3d4faa3d..ae8b9cf90 100644
--- a/usr.sbin/bhyve/pci_passthru.c
+++ b/usr.sbin/bhyve/pci_passthru.c
@@ -811,8 +811,8 @@ passthru_cfgread(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
 	if (coff == PCIR_COMMAND) {
 		if (bytes <= 2)
 			return (-1);
-		*rv = pci_get_cfgdata16(pi, PCIR_COMMAND) << 16 |
-		    read_config(&sc->psc_sel, PCIR_STATUS, 2);
+		*rv = pci_get_cfgdata16(pi, PCIR_COMMAND) |
+			read_config(&sc->psc_sel, PCIR_STATUS, 2) << 16;
 		return (0);
 	}