diff --git a/tools/widl/typegen.c b/tools/widl/typegen.c
index f40399f16b2..55fb3fa32ef 100644
--- a/tools/widl/typegen.c
+++ b/tools/widl/typegen.c
@@ -1472,11 +1472,9 @@ static size_t write_string_tfs(FILE *file, const attr_list_t *attrs,
                                const char *name, unsigned int *typestring_offset,
                                int toplevel)
 {
-    size_t start_offset = *typestring_offset;
+    size_t start_offset;
     unsigned char rtype;
 
-    update_tfsoff(type, start_offset, file);
-
     if (toplevel && is_declptr(type))
     {
         unsigned char flag = is_conformant_array(type) ? 0 : RPC_FC_P_SIMPLEPOINTER;
@@ -1494,6 +1492,9 @@ static size_t write_string_tfs(FILE *file, const attr_list_t *attrs,
         }
     }
 
+    start_offset = *typestring_offset;
+    update_tfsoff(type, start_offset, file);
+
     rtype = type->ref->type;
 
     if ((rtype != RPC_FC_BYTE) && (rtype != RPC_FC_CHAR) && (rtype != RPC_FC_WCHAR))
@@ -2743,10 +2744,11 @@ static void write_remoting_arg(FILE *file, int indent, const func_t *func,
             }
 
             if ((phase == PHASE_FREE) || (pointer_type == RPC_FC_UP))
-                print_phase_function(file, indent, "Pointer", phase, var, start_offset);
+                print_phase_function(file, indent, "Pointer", phase, var,
+                                     start_offset - (type->size_is ? 4 : 2));
             else
                 print_phase_function(file, indent, "ConformantString", phase, var,
-                                     start_offset + (type->size_is ? 4 : 2));
+                                     start_offset);
         }
     }
     else if (is_array(type))