diff --git a/chardev/char.c b/chardev/char.c
index 608c2569f4..ef6d07e132 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -100,7 +100,7 @@ static void qemu_chr_write_log(Chardev *s, const uint8_t *buf, size_t len)
 
 static int qemu_chr_write_buffer(Chardev *s,
                                  const uint8_t *buf, int len,
-                                 int *offset, bool write_all)
+                                 size_t *offset, bool write_all)
 {
     ChardevClass *cc = CHARDEV_GET_CLASS(s);
     int res = 0;
@@ -132,9 +132,10 @@ static int qemu_chr_write_buffer(Chardev *s,
     return res;
 }
 
-int qemu_chr_write(Chardev *s, const uint8_t *buf, int len, bool write_all)
+size_t qemu_chr_write(Chardev *s, const uint8_t *buf, size_t len,
+                      bool write_all)
 {
-    int offset = 0;
+    size_t offset = 0;
     int res;
 
     if (qemu_chr_replay(s) && replay_mode == REPLAY_MODE_PLAY) {
@@ -156,21 +157,21 @@ int qemu_chr_write(Chardev *s, const uint8_t *buf, int len, bool write_all)
     return offset;
 }
 
-int qemu_chr_be_can_write(Chardev *s)
+size_t qemu_chr_be_can_write(Chardev *s)
 {
     CharBackend *be = s->be;
-    int res;
+    size_t res;
 
     if (!be || !be->chr_can_read) {
         return 0;
     }
 
     res = be->chr_can_read(be->opaque);
-    assert(res >= 0);
+    assert((ssize_t)res >= 0); /* "fail-safe" assertion */
     return res;
 }
 
-void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, int len)
+void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, size_t len)
 {
     CharBackend *be = s->be;
 
@@ -179,7 +180,7 @@ void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, int len)
     }
 }
 
-void qemu_chr_be_write(Chardev *s, uint8_t *buf, int len)
+void qemu_chr_be_write(Chardev *s, uint8_t *buf, size_t len)
 {
     if (qemu_chr_replay(s)) {
         if (replay_mode == REPLAY_MODE_PLAY) {
diff --git a/include/chardev/char.h b/include/chardev/char.h
index 091a514022..65f93adbd6 100644
--- a/include/chardev/char.h
+++ b/include/chardev/char.h
@@ -163,7 +163,7 @@ Chardev *qemu_chr_new_noreplay(const char *label, const char *filename,
  *
  * Returns: the number of bytes the front end can receive via @qemu_chr_be_write
  */
-int qemu_chr_be_can_write(Chardev *s);
+size_t qemu_chr_be_can_write(Chardev *s);
 
 /**
  * qemu_chr_be_write:
@@ -174,7 +174,7 @@ int qemu_chr_be_can_write(Chardev *s);
  * the caller should call @qemu_chr_be_can_write to determine how much data
  * the front end can currently accept.
  */
-void qemu_chr_be_write(Chardev *s, uint8_t *buf, int len);
+void qemu_chr_be_write(Chardev *s, uint8_t *buf, size_t len);
 
 /**
  * qemu_chr_be_write_impl:
@@ -183,7 +183,7 @@ void qemu_chr_be_write(Chardev *s, uint8_t *buf, int len);
  *
  * Implementation of back end writing. Used by replay module.
  */
-void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, int len);
+void qemu_chr_be_write_impl(Chardev *s, uint8_t *buf, size_t len);
 
 /**
  * qemu_chr_be_update_read_handlers:
@@ -211,7 +211,8 @@ void qemu_chr_set_feature(Chardev *chr,
                           ChardevFeature feature);
 QemuOpts *qemu_chr_parse_compat(const char *label, const char *filename,
                                 bool permit_mux_mon);
-int qemu_chr_write(Chardev *s, const uint8_t *buf, int len, bool write_all);
+size_t qemu_chr_write(Chardev *s, const uint8_t *buf, size_t len,
+                      bool write_all);
 #define qemu_chr_write_all(s, buf, len) qemu_chr_write(s, buf, len, true)
 int qemu_chr_wait_connected(Chardev *chr, Error **errp);
 
diff --git a/include/sysemu/replay.h b/include/sysemu/replay.h
index 7f7a594eca..0856b66888 100644
--- a/include/sysemu/replay.h
+++ b/include/sysemu/replay.h
@@ -148,17 +148,17 @@ uint64_t blkreplay_next_id(void);
 /*! Registers char driver to save it's events */
 void replay_register_char_driver(struct Chardev *chr);
 /*! Saves write to char device event to the log */
-void replay_chr_be_write(struct Chardev *s, uint8_t *buf, int len);
+void replay_chr_be_write(struct Chardev *s, uint8_t *buf, size_t len);
 /*! Writes char write return value to the replay log. */
-void replay_char_write_event_save(int res, int offset);
+void replay_char_write_event_save(int res, size_t offset);
 /*! Reads char write return value from the replay log. */
-void replay_char_write_event_load(int *res, int *offset);
+void replay_char_write_event_load(int *res, size_t *offset);
 /*! Reads information about read_all character event. */
 int replay_char_read_all_load(uint8_t *buf);
 /*! Writes character read_all error code into the replay log. */
 void replay_char_read_all_save_error(int res);
 /*! Writes character read_all execution result into the replay log. */
-void replay_char_read_all_save_buf(uint8_t *buf, int offset);
+void replay_char_read_all_save_buf(uint8_t *buf, size_t offset);
 
 /* Network */
 
diff --git a/replay/replay-char.c b/replay/replay-char.c
index 736cc8c2e6..9c4ec3c794 100644
--- a/replay/replay-char.c
+++ b/replay/replay-char.c
@@ -49,7 +49,7 @@ void replay_register_char_driver(Chardev *chr)
     char_drivers[drivers_count++] = chr;
 }
 
-void replay_chr_be_write(Chardev *s, uint8_t *buf, int len)
+void replay_chr_be_write(Chardev *s, uint8_t *buf, size_t len)
 {
     CharEvent *event = g_malloc0(sizeof(CharEvent));
 
@@ -94,7 +94,7 @@ void *replay_event_char_read_load(void)
     return event;
 }
 
-void replay_char_write_event_save(int res, int offset)
+void replay_char_write_event_save(int res, size_t offset)
 {
     g_assert(replay_mutex_locked());
 
@@ -104,7 +104,7 @@ void replay_char_write_event_save(int res, int offset)
     replay_put_dword(offset);
 }
 
-void replay_char_write_event_load(int *res, int *offset)
+void replay_char_write_event_load(int *res, size_t *offset)
 {
     g_assert(replay_mutex_locked());
 
@@ -150,7 +150,7 @@ void replay_char_read_all_save_error(int res)
     replay_put_dword(res);
 }
 
-void replay_char_read_all_save_buf(uint8_t *buf, int offset)
+void replay_char_read_all_save_buf(uint8_t *buf, size_t offset)
 {
     g_assert(replay_mutex_locked());
     replay_save_instructions();
diff --git a/stubs/replay.c b/stubs/replay.c
index 04279abb2c..030f508aef 100644
--- a/stubs/replay.c
+++ b/stubs/replay.c
@@ -34,17 +34,17 @@ void replay_register_char_driver(Chardev *chr)
 {
 }
 
-void replay_chr_be_write(Chardev *s, uint8_t *buf, int len)
+void replay_chr_be_write(Chardev *s, uint8_t *buf, size_t len)
 {
     abort();
 }
 
-void replay_char_write_event_save(int res, int offset)
+void replay_char_write_event_save(int res, size_t offset)
 {
     abort();
 }
 
-void replay_char_write_event_load(int *res, int *offset)
+void replay_char_write_event_load(int *res, size_t *offset)
 {
     abort();
 }
@@ -59,7 +59,7 @@ void replay_char_read_all_save_error(int res)
     abort();
 }
 
-void replay_char_read_all_save_buf(uint8_t *buf, int offset)
+void replay_char_read_all_save_buf(uint8_t *buf, size_t offset)
 {
     abort();
 }
