diff --git a/src/ap/dfs.c b/src/ap/dfs.c
index a11b2cf..20419f3 100644
--- a/src/ap/dfs.c
+++ b/src/ap/dfs.c
@@ -897,9 +897,8 @@
 		freq, ht_enabled, chan_offset, chan_width, cf1, cf2);
 
 	/* mark radar frequency as invalid */
-	res = set_dfs_state(iface, freq, ht_enabled, chan_offset,
-			    chan_width, cf1, cf2,
-			    HOSTAPD_CHAN_DFS_UNAVAILABLE);
+	set_dfs_state(iface, freq, ht_enabled, chan_offset, chan_width,
+		      cf1, cf2, HOSTAPD_CHAN_DFS_UNAVAILABLE);
 
 	/* Skip if reported radar event not overlapped our channels */
 	res = dfs_are_channels_overlapped(iface, freq, chan_width, cf1, cf2);
diff --git a/wpa_supplicant/p2p_supplicant.c b/wpa_supplicant/p2p_supplicant.c
index 1ad1a95..0af5e32 100644
--- a/wpa_supplicant/p2p_supplicant.c
+++ b/wpa_supplicant/p2p_supplicant.c
@@ -786,7 +786,7 @@
 		os_memcpy(n + s->num_p2p_clients * ETH_ALEN, addr, ETH_ALEN);
 		s->p2p_client_list = n;
 		s->num_p2p_clients++;
-	} else if (!found) {
+	} else if (!found && s->p2p_client_list) {
 		/* Not enough room for an additional entry - drop the oldest
 		 * entry */
 		os_memmove(s->p2p_client_list,
@@ -3188,7 +3188,7 @@
 			      ETH_ALEN) == 0)
 			break;
 	}
-	if (i >= ssid->num_p2p_clients) {
+	if (i >= ssid->num_p2p_clients || !ssid->p2p_client_list) {
 		if (ssid->mode != WPAS_MODE_P2P_GO &&
 		    os_memcmp(ssid->bssid, peer, ETH_ALEN) == 0) {
 			wpa_printf(MSG_DEBUG, "P2P: Remove persistent group %d "
diff --git a/wpa_supplicant/scan.c b/wpa_supplicant/scan.c
index b13713c..40eb8d8 100644
--- a/wpa_supplicant/scan.c
+++ b/wpa_supplicant/scan.c
@@ -1931,7 +1931,7 @@
 int wpas_start_pno(struct wpa_supplicant *wpa_s)
 {
 	int ret, interval;
-	size_t i, num_ssid;
+	size_t i, num_ssid, num_match_ssid;
 	struct wpa_ssid *ssid;
 	struct wpa_driver_scan_params params;
 
@@ -1960,41 +1960,58 @@
 
 	os_memset(&params, 0, sizeof(params));
 
-	num_ssid = 0;
+	num_ssid = num_match_ssid = 0;
 	ssid = wpa_s->conf->ssid;
 	while (ssid) {
-		if (!wpas_network_disabled(wpa_s, ssid))
-			num_ssid++;
+		if (!wpas_network_disabled(wpa_s, ssid)) {
+			num_match_ssid++;
+			if (ssid->scan_ssid)
+				num_ssid++;
+		}
 		ssid = ssid->next;
 	}
+
+	if (num_match_ssid == 0) {
+		wpa_printf(MSG_DEBUG, "PNO: No configured SSIDs");
+		return -1;
+	}
+
+	if (num_match_ssid > num_ssid) {
+		params.num_ssids++; /* wildcard */
+		num_ssid++;
+	}
+
 	if (num_ssid > WPAS_MAX_SCAN_SSIDS) {
 		wpa_printf(MSG_DEBUG, "PNO: Use only the first %u SSIDs from "
 			   "%u", WPAS_MAX_SCAN_SSIDS, (unsigned int) num_ssid);
 		num_ssid = WPAS_MAX_SCAN_SSIDS;
 	}
 
-	if (num_ssid == 0) {
-		wpa_printf(MSG_DEBUG, "PNO: No configured SSIDs");
-		return -1;
+	if (num_match_ssid > wpa_s->max_match_sets) {
+		num_match_ssid = wpa_s->max_match_sets;
+		wpa_dbg(wpa_s, MSG_DEBUG, "PNO: Too many SSIDs to match");
 	}
-
-	params.filter_ssids = os_malloc(sizeof(struct wpa_driver_scan_filter) *
-					num_ssid);
+	params.filter_ssids = os_calloc(num_match_ssid,
+					sizeof(struct wpa_driver_scan_filter));
 	if (params.filter_ssids == NULL)
 		return -1;
 	i = 0;
 	ssid = wpa_s->conf->ssid;
 	while (ssid) {
 		if (!wpas_network_disabled(wpa_s, ssid)) {
-			params.ssids[i].ssid = ssid->ssid;
-			params.ssids[i].ssid_len = ssid->ssid_len;
-			params.num_ssids++;
+			if (ssid->scan_ssid && params.num_ssids < num_ssid) {
+				params.ssids[params.num_ssids].ssid =
+					ssid->ssid;
+				params.ssids[params.num_ssids].ssid_len =
+					 ssid->ssid_len;
+				params.num_ssids++;
+			}
 			os_memcpy(params.filter_ssids[i].ssid, ssid->ssid,
 				  ssid->ssid_len);
 			params.filter_ssids[i].ssid_len = ssid->ssid_len;
 			params.num_filter_ssids++;
 			i++;
-			if (i == num_ssid)
+			if (i == num_match_ssid)
 				break;
 		}
 		ssid = ssid->next;