diff --git a/minimateplus/protocol.py b/minimateplus/protocol.py
index afc38d1..ef285b0 100644
--- a/minimateplus/protocol.py
+++ b/minimateplus/protocol.py
@@ -95,12 +95,10 @@ DATA_LENGTHS: dict[int, int] = {
 # Confirmed from 1-2-26 BW TX capture analysis (2026-04-02).
 _BULK_CHUNK_OFFSET = 0x1004   # offset field for probe + all regular chunk requests ✅
 _BULK_TERM_OFFSET  = 0x005A   # offset field for termination request ✅
-_BULK_COUNTER_STEP = 0x0400   # chunk counter increment per request ✅
-# Note: BW's second chunk used counter=0x1004 rather than the expected 0x0400.
-# This appears to be a waveform-specific pre-trigger byte offset unique to BW's
-# implementation.  All subsequent chunks incremented by 0x0400 as expected.
-# 🔶 INFERRED: device echoes the counter back but may not validate it.
-# Confirm empirically on first live test.
+_BULK_COUNTER_STEP = 0x0400   # chunk counter increment for chunks 2+ ✅
+# Chunk 1 counter is 0x1004 (NOT 1 * 0x0400 = 0x0400).  Confirmed from 4-2-26 BW TX
+# capture.  Chunks 2+ use n * 0x0400 (0x0800, 0x0C00, …).  Device silently ignores
+# frames with wrong counter — this was the root cause of the full-waveform timeout.
 
 # Default timeout values (seconds).
 # MiniMate Plus is a slow device — keep these generous.
@@ -472,8 +470,11 @@ class MiniMateProtocol:
         log.debug("5A A5[0]  page_key=0x%04X  %d bytes", rsp.page_key, len(rsp.data))
 
         # ── Step 2: chunk loop ───────────────────────────────────────────────
+        # Chunk 1 uses a fixed counter of 0x1004, confirmed from 4-2-26 BW TX capture.
+        # Chunks 2+ use n * 0x0400.  Device silently ignores frames with wrong counter.
+        _CHUNK1_COUNTER = 0x1004
         for chunk_num in range(1, max_chunks + 1):
-            counter = chunk_num * _BULK_COUNTER_STEP
+            counter = _CHUNK1_COUNTER if chunk_num == 1 else chunk_num * _BULK_COUNTER_STEP
             params  = bulk_waveform_params(key4, counter)
             log.debug("5A chunk %d  counter=0x%04X", chunk_num, counter)
             self._send(build_5a_frame(_BULK_CHUNK_OFFSET, params))