diff --git a/src/eap_peer/eap.c b/src/eap_peer/eap.c
index 721c9d6..269d719 100644
--- a/src/eap_peer/eap.c
+++ b/src/eap_peer/eap.c
@@ -2850,8 +2850,9 @@
 	}
 
 	/* Look for the realm of the anonymous identity. */
-	realm = strnchr(config->anonymous_identity,
-	    config->anonymous_identity_len, '@');
+	identity = config->anonymous_identity;
+	identity_len = config->anonymous_identity_len;
+	realm = strnchr(identity, identity_len, '@');
 	if (NULL != realm) {
 		wpa_printf(MSG_DEBUG, "Get the realm from anonymous identity.");
 		*len = identity_len - (realm - identity);
@@ -2859,8 +2860,9 @@
 	}
 
 	/* Look for the realm of the real identity. */
-	realm = strnchr(config->imsi_identity,
-	    config->imsi_identity_len, '@');
+	identity = config->imsi_identity;
+	identity_len = config->imsi_identity_len;
+	realm = strnchr(identity, identity_len, '@');
 	if (NULL != realm) {
 		wpa_printf(MSG_DEBUG, "Get the realm from IMSI identity.");
 		*len = identity_len - (realm - identity);
diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index cb42994..4503ae9 100644
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -1907,7 +1907,9 @@
 
 #ifdef CONFIG_DRIVER_NL80211_BRCM
 	if ((wpa_s->key_mgmt & WPA_KEY_MGMT_CROSS_AKM_ROAM) &&
-	    IS_CROSS_AKM_ROAM_KEY_MGMT(ssid->key_mgmt)) {
+		IS_CROSS_AKM_ROAM_KEY_MGMT(ssid->key_mgmt) &&
+		(wpa_s->group_cipher == WPA_CIPHER_CCMP) &&
+		(wpa_s->pairwise_cipher == WPA_CIPHER_CCMP)) {
 		wpa_s->key_mgmt = WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_PSK;
 		wpa_dbg(wpa_s, MSG_INFO,
 			"WPA: Updating to KEY_MGMT SAE+PSK for seamless roaming");