diff --git a/drv/cosmo-hf/src/hf.rs b/drv/cosmo-hf/src/hf.rs
index cf90f127ca..67d0b56d2f 100644
--- a/drv/cosmo-hf/src/hf.rs
+++ b/drv/cosmo-hf/src/hf.rs
@@ -268,13 +268,13 @@ impl idl::InOrderHostFlashImpl for ServerImpl {
         &mut self,
         _: &RecvMessage,
         addr: u32,
-        dest: LenLimit<Leased<W, [u8]>, PAGE_SIZE_BYTES>,
+        dest: Leased<W, [u8]>,
     ) -> Result<(), RequestError<HfError>> {
         self.drv.check_flash_mux_state()?;
         self.drv
             .flash_read(
                 self.flash_addr(addr),
-                &mut LeaseBufWriter::<_, 32>::from(dest.into_inner()),
+                &mut LeaseBufWriter::<_, 32>::from(dest),
             )
             .map_err(|_| RequestError::went_away())
     }
@@ -483,7 +483,7 @@ impl idl::InOrderHostFlashImpl for FailServer {
         &mut self,
         _: &RecvMessage,
         _offset: u32,
-        _dest: LenLimit<Leased<W, [u8]>, PAGE_SIZE_BYTES>,
+        _dest: Leased<W, [u8]>,
     ) -> Result<(), RequestError<HfError>> {
         Err(self.err.into())
     }
diff --git a/drv/cosmo-hf/src/main.rs b/drv/cosmo-hf/src/main.rs
index 7f8ebc2316..16484d92f4 100644
--- a/drv/cosmo-hf/src/main.rs
+++ b/drv/cosmo-hf/src/main.rs
@@ -241,11 +241,11 @@ impl FlashDriver {
 
     /// Reads data from the given address into a `BufWriter`
     ///
-    /// This function will only return an error if it fails to read from a
+    /// This function will only return an error if it fails to write to a
     /// provided lease; when given a slice, it is infallible.
     fn flash_read(
         &mut self,
-        offset: u32,
+        mut offset: u32,
         dest: &mut dyn idol_runtime::BufWriter<'_>,
     ) -> Result<(), ()> {
         loop {
@@ -269,6 +269,7 @@ impl FlashDriver {
                     }
                 }
             }
+            offset += len as u32;
         }
         Ok(())
     }
diff --git a/drv/gimlet-hf-server/src/main.rs b/drv/gimlet-hf-server/src/main.rs
index b7c2f4f4ba..608fbd3a42 100644
--- a/drv/gimlet-hf-server/src/main.rs
+++ b/drv/gimlet-hf-server/src/main.rs
@@ -505,14 +505,21 @@ impl idl::InOrderHostFlashImpl for ServerImpl {
     fn read(
         &mut self,
         _: &RecvMessage,
-        addr: u32,
-        dest: LenLimit<Leased<W, [u8]>, PAGE_SIZE_BYTES>,
+        mut addr: u32,
+        dest: Leased<W, [u8]>,
     ) -> Result<(), RequestError<HfError>> {
         self.check_muxed_to_sp()?;
-        self.qspi.read_memory(addr, &mut self.block[..dest.len()]);
+        let mut offset = 0;
+        for i in (0..dest.len()).step_by(self.block.len()) {
+            let n = (dest.len() - i).min(self.block.len());
 
-        dest.write_range(0..dest.len(), &self.block[..dest.len()])
-            .map_err(|_| RequestError::Fail(ClientError::WentAway))?;
+            self.qspi.read_memory(addr, &mut self.block[..n]);
+
+            dest.write_range(offset..offset + n, &self.block[..n])
+                .map_err(|_| RequestError::Fail(ClientError::WentAway))?;
+            addr += n as u32;
+            offset += n;
+        }
 
         Ok(())
     }
diff --git a/drv/mock-gimlet-hf-server/src/main.rs b/drv/mock-gimlet-hf-server/src/main.rs
index c312975a49..b3e7457bab 100644
--- a/drv/mock-gimlet-hf-server/src/main.rs
+++ b/drv/mock-gimlet-hf-server/src/main.rs
@@ -89,12 +89,17 @@ impl idl::InOrderHostFlashImpl for ServerImpl {
         &mut self,
         _: &RecvMessage,
         _addr: u32,
-        dest: LenLimit<Leased<W, [u8]>, PAGE_SIZE_BYTES>,
+        dest: Leased<W, [u8]>,
     ) -> Result<(), RequestError<HfError>> {
         let zero = [0; PAGE_SIZE_BYTES];
-
-        dest.write_range(0..dest.len(), &zero[..dest.len()])
-            .map_err(|_| RequestError::Fail(ClientError::WentAway))?;
+        let mut offset = 0;
+        for i in (0..dest.len()).step_by(zero.len()) {
+            let n = (dest.len() - i).min(zero.len());
+
+            dest.write_range(offset..offset + n, &zero[..n])
+                .map_err(|_| RequestError::Fail(ClientError::WentAway))?;
+            offset += n;
+        }
 
         Ok(())
     }
diff --git a/idl/hf.idol b/idl/hf.idol
index e72144e569..a5c024115f 100644
--- a/idl/hf.idol
+++ b/idl/hf.idol
@@ -58,7 +58,7 @@ Interface(
                 "address": "u32",
             },
             leases: {
-                "data": (type: "[u8]", write: true, max_len: Some(256)),
+                "data": (type: "[u8]", write: true),
             },
             reply: Result(
                 ok: "()",