diff --git a/libs/binder/RpcState.cpp b/libs/binder/RpcState.cpp
index 6563bc8..23382c3 100644
--- a/libs/binder/RpcState.cpp
+++ b/libs/binder/RpcState.cpp
@@ -601,7 +601,7 @@
 status_t RpcState::drainCommands(const sp<RpcSession::RpcConnection>& connection,
                                  const sp<RpcSession>& session, CommandType type) {
     uint8_t buf;
-    while (connection->rpcTransport->peek(&buf, sizeof(buf)).value_or(-1) > 0) {
+    while (connection->rpcTransport->peek(&buf, sizeof(buf)).value_or(0) > 0) {
         status_t status = getAndExecuteCommand(connection, session, type);
         if (status != OK) return status;
     }
diff --git a/libs/binder/RpcTransportRaw.cpp b/libs/binder/RpcTransportRaw.cpp
index 953d233..2fc1945 100644
--- a/libs/binder/RpcTransportRaw.cpp
+++ b/libs/binder/RpcTransportRaw.cpp
@@ -32,21 +32,21 @@
 class RpcTransportRaw : public RpcTransport {
 public:
     explicit RpcTransportRaw(android::base::unique_fd socket) : mSocket(std::move(socket)) {}
-    Result<ssize_t> send(const void *buf, int size) override {
+    Result<size_t> send(const void *buf, size_t size) override {
         ssize_t ret = TEMP_FAILURE_RETRY(::send(mSocket.get(), buf, size, MSG_NOSIGNAL));
         if (ret < 0) {
             return ErrnoError() << "send()";
         }
         return ret;
     }
-    Result<ssize_t> recv(void *buf, int size) override {
+    Result<size_t> recv(void *buf, size_t size) override {
         ssize_t ret = TEMP_FAILURE_RETRY(::recv(mSocket.get(), buf, size, MSG_NOSIGNAL));
         if (ret < 0) {
             return ErrnoError() << "recv()";
         }
         return ret;
     }
-    Result<ssize_t> peek(void *buf, int size) override {
+    Result<size_t> peek(void *buf, size_t size) override {
         ssize_t ret = TEMP_FAILURE_RETRY(::recv(mSocket.get(), buf, size, MSG_PEEK | MSG_DONTWAIT));
         if (ret < 0) {
             return ErrnoError() << "recv(MSG_PEEK)";
diff --git a/libs/binder/include/binder/RpcTransport.h b/libs/binder/include/binder/RpcTransport.h
index 1778cae..1164600 100644
--- a/libs/binder/include/binder/RpcTransport.h
+++ b/libs/binder/include/binder/RpcTransport.h
@@ -32,10 +32,10 @@
     virtual ~RpcTransport() = default;
 
     // replacement of ::send(). errno may not be set if TLS is enabled.
-    virtual android::base::Result<ssize_t> send(const void *buf, int size) = 0;
+    virtual android::base::Result<size_t> send(const void *buf, size_t size) = 0;
 
     // replacement of ::recv(). errno may not be set if TLS is enabled.
-    virtual android::base::Result<ssize_t> recv(void *buf, int size) = 0;
+    virtual android::base::Result<size_t> recv(void *buf, size_t size) = 0;
 
     // replacement of ::recv(MSG_PEEK). errno may not be set if TLS is enabled.
     //
@@ -44,7 +44,7 @@
     // into an internal buffer in userspace. After that, pending() == true.
     // - For raw sockets, this calls ::recv(MSG_PEEK), which leaves the data in the kernel buffer;
     // pending() is always false.
-    virtual android::base::Result<ssize_t> peek(void *buf, int size) = 0;
+    virtual android::base::Result<size_t> peek(void *buf, size_t size) = 0;
 
     // Returns true if there are data pending in a userspace buffer that RpcTransport holds.
     //