diff --git a/drivers/wlan/wlan/device.cpp b/drivers/wlan/wlan/device.cpp
index e74ac0f..790cb08 100644
--- a/drivers/wlan/wlan/device.cpp
+++ b/drivers/wlan/wlan/device.cpp
@@ -419,7 +419,7 @@
         return ZX_ERR_INVALID_ARGS;
     }
 
-    if (ethmac_proxy_ != nullptr) { ethmac_proxy_->Recv(packet->mut_data(), packet->len(), 0u); }
+    if (ethmac_proxy_ != nullptr) { ethmac_proxy_->Recv(packet->data(), packet->len(), 0u); }
     return ZX_OK;
 }
 
diff --git a/lib/wlan/mlme/ap/beacon_sender.cpp b/lib/wlan/mlme/ap/beacon_sender.cpp
index 5f61f51..93ef7e1 100644
--- a/lib/wlan/mlme/ap/beacon_sender.cpp
+++ b/lib/wlan/mlme/ap/beacon_sender.cpp
@@ -50,7 +50,7 @@
     // Copy template content.
     auto packet = frame.Take();
     bcn_cfg.tmpl.packet_head.len = packet->len();
-    bcn_cfg.tmpl.packet_head.data = packet->mut_data();
+    bcn_cfg.tmpl.packet_head.data = packet->data();
     bcn_cfg.beacon_interval = req.body()->beacon_period;
     status = device_->EnableBeaconing(&bcn_cfg);
     if (status != ZX_OK) {
diff --git a/lib/wlan/mlme/include/wlan/mlme/buffer_reader.h b/lib/wlan/mlme/include/wlan/mlme/buffer_reader.h
index a15e3b2..259b7ce 100644
--- a/lib/wlan/mlme/include/wlan/mlme/buffer_reader.h
+++ b/lib/wlan/mlme/include/wlan/mlme/buffer_reader.h
@@ -5,6 +5,7 @@
 #pragma once
 
 #include <fbl/unique_ptr.h>
+#include <wlan/common/span.h>
 #include <wlan/mlme/packet.h>
 #include <zircon/types.h>
 
@@ -12,49 +13,43 @@
 
 class BufferReader {
    public:
-    BufferReader(const uint8_t* buf, size_t len) : buf_(buf), len_(len) {
-        ZX_ASSERT(buf != nullptr);
-    }
-
-    explicit BufferReader(const Packet* pkt) : buf_(pkt->data()), len_(pkt->len()) {
-        ZX_ASSERT(pkt != nullptr);
+    explicit BufferReader(Span<const uint8_t> buf) : buf_(buf) {
+        ZX_ASSERT(buf_.data() != nullptr);
     }
 
     template <typename T> const T* Peek() {
-        if (len_ < offset_ + sizeof(T)) { return nullptr; }
-        return reinterpret_cast<const T*>(buf_ + offset_);
+        if (buf_.size() < offset_ + sizeof(T)) { return nullptr; }
+        return reinterpret_cast<const T*>(buf_.data() + offset_);
     }
 
     template <typename T> const T* Read() {
-        if (len_ < offset_ + sizeof(T)) { return nullptr; }
+        if (buf_.size() < offset_ + sizeof(T)) { return nullptr; }
 
-        auto data = reinterpret_cast<const T*>(buf_ + offset_);
+        auto data = reinterpret_cast<const T*>(buf_.data() + offset_);
         offset_ += sizeof(T);
         return data;
     }
 
-    const uint8_t* Read(size_t len) {
-        if (len_ < offset_ + len) { return nullptr; }
+    Span<const uint8_t> Read(size_t len) {
+        if (buf_.size() < offset_ + len) { return {}; }
 
-        auto data = buf_ + offset_;
+        auto data = buf_.data() + offset_;
         offset_ += len;
+        return {data, len};
+    }
+
+    Span<const uint8_t> ReadRemaining() {
+        auto data = buf_.subspan(offset_);
+        offset_ = buf_.size();
         return data;
     }
 
-    std::tuple<const uint8_t*, size_t> ReadRemaining() {
-        size_t remaining = RemainingBytes();
-        auto data = buf_ + offset_;
-        offset_ += remaining;
-        return {data, remaining};
-    }
-
     size_t ReadBytes() const { return offset_; }
-    size_t RemainingBytes() const { return len_ - offset_; }
+    size_t RemainingBytes() const { return buf_.size() - offset_; }
 
    private:
+    Span<const uint8_t> buf_;
     size_t offset_ = 0;
-    const uint8_t* buf_;
-    size_t len_ = 0;
 };
 
 }  // namespace wlan
diff --git a/lib/wlan/mlme/include/wlan/mlme/buffer_writer.h b/lib/wlan/mlme/include/wlan/mlme/buffer_writer.h
index f9beb39..3f64fe1 100644
--- a/lib/wlan/mlme/include/wlan/mlme/buffer_writer.h
+++ b/lib/wlan/mlme/include/wlan/mlme/buffer_writer.h
@@ -5,6 +5,7 @@
 #pragma once
 
 #include <fbl/unique_ptr.h>
+#include <wlan/common/span.h>
 #include <wlan/mlme/packet.h>
 #include <zircon/types.h>
 
@@ -12,37 +13,32 @@
 
 class BufferWriter {
    public:
-    BufferWriter(uint8_t* buf, size_t len) : buf_(buf), len_(len) {
-        ZX_ASSERT(buf != nullptr);
-    }
-
-    explicit BufferWriter(Packet* pkt) : buf_(pkt->mut_data()), len_(pkt->len()) {
-        ZX_ASSERT(pkt != nullptr);
+    explicit BufferWriter(Span<uint8_t> buf) : buf_(buf) {
+        ZX_ASSERT(buf.data() != nullptr);
     }
 
     template <typename T> T* Write() {
-        ZX_ASSERT(len_ >= offset_ + sizeof(T));
+        ZX_ASSERT(buf_.size() >= offset_ + sizeof(T));
 
-        memset(buf_ + offset_, 0, sizeof(T));
-        auto data = reinterpret_cast<T*>(buf_ + offset_);
+        memset(buf_.data() + offset_, 0, sizeof(T));
+        auto data = reinterpret_cast<T*>(buf_.data() + offset_);
         offset_ += sizeof(T);
         return data;
     }
 
-    void Write(const uint8_t* buf, size_t len) {
-        ZX_ASSERT(len_ >= offset_ + len);
+    void Write(Span<const uint8_t> buf) {
+        ZX_ASSERT(buf_.size() >= offset_ + buf.size());
 
-        std::memcpy(buf_ + offset_, buf, len);
-        offset_ += len;
+        std::memcpy(buf_.data() + offset_, buf.data(), buf.size());
+        offset_ += buf.size();
     }
 
     size_t WrittenBytes() const { return offset_; }
-    size_t RemainingBytes() const { return len_ - offset_; }
+    size_t RemainingBytes() const { return buf_.size() - offset_; }
 
 private:
     size_t offset_ = 0;
-    uint8_t* buf_;
-    size_t len_ = 0;
+    Span<uint8_t> buf_;
 };
 
 }  // namespace wlan
diff --git a/lib/wlan/mlme/include/wlan/mlme/packet.h b/lib/wlan/mlme/include/wlan/mlme/packet.h
index 848dc41..3c5ab90 100644
--- a/lib/wlan/mlme/include/wlan/mlme/packet.h
+++ b/lib/wlan/mlme/include/wlan/mlme/packet.h
@@ -5,6 +5,7 @@
 #ifndef GARNET_LIB_WLAN_MLME_INCLUDE_WLAN_MLME_PACKET_H_
 #define GARNET_LIB_WLAN_MLME_INCLUDE_WLAN_MLME_PACKET_H_
 
+#include <wlan/common/span.h>
 #include <wlan/mlme/wlan.h>
 
 #include <fbl/intrusive_double_list.h>
@@ -142,6 +143,8 @@
 // within the buffer.
 class Packet : public fbl::DoublyLinkedListable<fbl::unique_ptr<Packet>> {
    public:
+    typedef uint8_t value_type;
+
     enum class Peer {
         kUnknown,
         kDevice,
@@ -162,7 +165,9 @@
     Peer peer() const { return peer_; }
 
     const uint8_t* data() const { return buffer_->data(); }
-    uint8_t* mut_data() { return buffer_->data(); }
+    uint8_t* data() { return buffer_->data(); }
+
+    size_t size() const { return len_; }
 
     // Length can only be made shorter at this time.
     zx_status_t set_len(size_t len) {
diff --git a/lib/wlan/mlme/mesh/mesh_mlme.cpp b/lib/wlan/mlme/mesh/mesh_mlme.cpp
index bfc877b..3068d7e 100644
--- a/lib/wlan/mlme/mesh/mesh_mlme.cpp
+++ b/lib/wlan/mlme/mesh/mesh_mlme.cpp
@@ -102,7 +102,7 @@
 
     auto packet = buffer.Take();
     cfg.tmpl.packet_head.len = packet->len();
-    cfg.tmpl.packet_head.data = packet->mut_data();
+    cfg.tmpl.packet_head.data = packet->data();
     cfg.beacon_interval = req.body()->beacon_period;
     status = device_->EnableBeaconing(&cfg);
     if (status != ZX_OK) {
diff --git a/lib/wlan/mlme/packet.cpp b/lib/wlan/mlme/packet.cpp
index 266fe59..a2beb96 100644
--- a/lib/wlan/mlme/packet.cpp
+++ b/lib/wlan/mlme/packet.cpp
@@ -27,7 +27,7 @@
 wlan_tx_packet_t Packet::AsWlanTxPacket() {
     ZX_DEBUG_ASSERT(len() <= fbl::numeric_limits<uint16_t>::max());
     wlan_tx_packet_t tx_pkt = {};
-    tx_pkt.packet_head.data = mut_data();
+    tx_pkt.packet_head.data = data();
     tx_pkt.packet_head.len = static_cast<uint16_t>(len());
     if (has_ext_data()) {
         tx_pkt.packet_tail = ext_data();
diff --git a/lib/wlan/mlme/tests/buffer_utils_unittest.cpp b/lib/wlan/mlme/tests/buffer_utils_unittest.cpp
index af6afef..c4e7088 100644
--- a/lib/wlan/mlme/tests/buffer_utils_unittest.cpp
+++ b/lib/wlan/mlme/tests/buffer_utils_unittest.cpp
@@ -22,7 +22,7 @@
     uint8_t buf[16] = {};
     std::iota(buf, buf + sizeof(buf), 0);
 
-    BufferWriter w(buf, sizeof(buf));
+    BufferWriter w(buf);
     auto c1 = w.Write<Container<4>>();
     c1->data[0] = 1;
     c1->data[1] = 0;
@@ -34,7 +34,7 @@
     c2->data[1] = 4;
 
     uint8_t data[4] = {5, 6, 7, 8};
-    w.Write(data, sizeof(data));
+    w.Write(data);
 
     EXPECT_EQ(w.WrittenBytes(), 10u);
     EXPECT_EQ(w.RemainingBytes(), 6u);
@@ -51,7 +51,7 @@
     uint8_t buf[16] = {};
     std::iota(buf, buf + sizeof(buf), 0);
 
-    BufferReader r(buf, sizeof(buf));
+    BufferReader r(buf);
     auto c1 = r.Read<Container<4>>();
     ASSERT_NE(c1, nullptr);
     EXPECT_EQ(c1->data[0], 0u);
@@ -68,7 +68,8 @@
     EXPECT_EQ(c3->data[2], 8u);
 
     auto read_data = r.Read(3);
-    ASSERT_NE(read_data, nullptr);
+    ASSERT_FALSE(read_data.empty());
+    ASSERT_EQ(read_data.size(), 3u);
     EXPECT_EQ(read_data[0], 6u);
     EXPECT_EQ(read_data[2], 8u);
 
@@ -76,13 +77,13 @@
     EXPECT_EQ(r.RemainingBytes(), 7u);
 
     // Read over the remaining buffer size.
-    EXPECT_EQ(r.Read(8), nullptr);
+    EXPECT_TRUE(r.Read(8).empty());
     EXPECT_EQ(r.Peek<Container<8>>(), nullptr);
     EXPECT_EQ(r.Read<Container<8>>(), nullptr);
 
-    auto [remaining, remaining_len] = r.ReadRemaining();
-    ASSERT_NE(remaining, nullptr);
-    ASSERT_EQ(remaining_len, 7u);
+    auto remaining = r.ReadRemaining();
+    ASSERT_NE(remaining.data(), nullptr);
+    ASSERT_EQ(remaining.size(), 7u);
     EXPECT_EQ(r.ReadBytes(), 16u);
     EXPECT_EQ(r.RemainingBytes(), 0u);
     EXPECT_EQ(remaining[0], 9u);
diff --git a/lib/wlan/mlme/tests/scanner_unittest.cpp b/lib/wlan/mlme/tests/scanner_unittest.cpp
index f4255c8..a7506c8 100644
--- a/lib/wlan/mlme/tests/scanner_unittest.cpp
+++ b/lib/wlan/mlme/tests/scanner_unittest.cpp
@@ -43,7 +43,7 @@
     // everyone.
     const size_t kBufLen = 4096;
     auto packet = GetSvcPacket(kBufLen);
-    memset(packet->mut_data(), 0, kBufLen);
+    memset(packet->data(), 0, kBufLen);
     SerializeServiceMsg(packet.get(), ordinal, msg.get());
     return fbl::move(packet);
 }
diff --git a/lib/wlan/mlme/tests/service_unittest.cpp b/lib/wlan/mlme/tests/service_unittest.cpp
index 3d16a5f..aa51e00 100644
--- a/lib/wlan/mlme/tests/service_unittest.cpp
+++ b/lib/wlan/mlme/tests/service_unittest.cpp
@@ -31,7 +31,7 @@
     // everyone.
     constexpr size_t kBufLen = 4096;
     auto packet = GetSvcPacket(kBufLen);
-    memset(packet->mut_data(), 0, kBufLen);
+    memset(packet->data(), 0, kBufLen);
     SerializeServiceMsg(packet.get(), ordinal, msg.get());
     return fbl::move(packet);
 }