diff --git a/docs/refguide.xml b/docs/refguide.xml
index 275b65a2a..758cb07b5 100644
--- a/docs/refguide.xml
+++ b/docs/refguide.xml
@@ -3024,7 +3024,7 @@ support the option completely, as does UDP scan.</para>
   argument isn't a zero or hex string, Nmap looks through
   <filename>nmap-mac-prefixes</filename> to find a vendor name containing the given string
   (it is case insensitive).  If a match is found, Nmap uses the
-  vendor's OUI (3-byte prefix)<indexterm><primary>organizationally unique identifier (OUI)</primary><seealso><filename>nmap-mac-prefixes</filename></seealso></indexterm>
+  vendor's OUI (three-byte prefix)<indexterm><primary>organizationally unique identifier (OUI)</primary><seealso><filename>nmap-mac-prefixes</filename></seealso></indexterm>
   and fills out the remaining three bytes
   randomly.  Valid <option>--spoof-mac</option> argument examples are <literal>Apple</literal>, <literal>0</literal>,
   <literal>01:02:03:04:05:06</literal>, <literal>deadbeefcafe</literal>, <literal>0020F2</literal>, and <literal>Cisco</literal>.  This option only affects raw packet scans such as SYN scan or OS detection, not connection-oriented features such as version detection or the Nmap Scripting Engine.</para>
diff --git a/docs/scripting.xml b/docs/scripting.xml
index 1448e01c6..07a8ea9a6 100644
--- a/docs/scripting.xml
+++ b/docs/scripting.xml
@@ -910,7 +910,7 @@ action refer to <xref linkend="nse-tutorial-action"/>.
 	      </term>
 	    <listitem>
 	      <para>MAC address<indexterm><primary>MAC address</primary></indexterm>
-                  of the destination host (6-byte long binary
+                  of the destination host (six-byte long binary
 		  string) or <literal>nil</literal>, if the host is not directly connected. 
 		  </para>
 	    </listitem>