diff --git a/src/ap/dfs.c b/src/ap/dfs.c
index 612f534..2b8b90f 100644
--- a/src/ap/dfs.c
+++ b/src/ap/dfs.c
@@ -214,6 +214,7 @@
 		break;
 	default:
 		wpa_printf(MSG_INFO, "DFS only VHT20/40/80/160 is supported now");
+		*vht_oper_centr_freq_seg0_idx = 0;
 		break;
 	}
 
@@ -359,6 +360,9 @@
 	u32 _rand;
 
 	wpa_printf(MSG_DEBUG, "DFS: Selecting random channel");
+	*secondary_channel = 0;
+	*vht_oper_centr_freq_seg0_idx = 0;
+	*vht_oper_centr_freq_seg1_idx = 0;
 
 	if (iface->current_mode == NULL)
 		return NULL;
diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c
index 6fb1056..3318f7a 100644
--- a/src/ap/drv_callbacks.c
+++ b/src/ap/drv_callbacks.c
@@ -678,6 +678,20 @@
 	struct hostapd_frame_info fi;
 	int ret;
 
+#ifdef CONFIG_TESTING_OPTIONS
+	if (hapd->ext_mgmt_frame_handling) {
+		size_t hex_len = 2 * rx_mgmt->frame_len + 1;
+		char *hex = os_malloc(hex_len);
+		if (hex) {
+			wpa_snprintf_hex(hex, hex_len, rx_mgmt->frame,
+					 rx_mgmt->frame_len);
+			wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-RX %s", hex);
+			os_free(hex);
+		}
+		return 1;
+	}
+#endif /* CONFIG_TESTING_OPTIONS */
+
 	hdr = (const struct ieee80211_hdr *) rx_mgmt->frame;
 	bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len);
 	if (bssid == NULL)
diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
index 75baec0..ad1c2d0 100644
--- a/src/ap/hostapd.c
+++ b/src/ap/hostapd.c
@@ -1807,6 +1807,7 @@
 			if (start_ctrl_iface_bss(hapd) < 0 ||
 			    (hapd_iface->state == HAPD_IFACE_ENABLED &&
 			     hostapd_setup_bss(hapd, -1))) {
+				hapd_iface->bss[hapd_iface->num_bss - 1] = NULL;
 				hapd_iface->conf->num_bss--;
 				hapd_iface->num_bss--;
 				wpa_printf(MSG_DEBUG, "%s: free hapd %p %s",
@@ -1876,14 +1877,17 @@
 		if (hapd_iface->bss) {
 			for (i = 0; i < hapd_iface->num_bss; i++) {
 				hapd = hapd_iface->bss[i];
-				if (hapd && hapd_iface->interfaces &&
+				if (!hapd)
+					continue;
+				if (hapd_iface->interfaces &&
 				    hapd_iface->interfaces->ctrl_iface_deinit)
 					hapd_iface->interfaces->
 						ctrl_iface_deinit(hapd);
 				wpa_printf(MSG_DEBUG, "%s: free hapd %p (%s)",
 					   __func__, hapd_iface->bss[i],
-					hapd_iface->bss[i]->conf->iface);
-				os_free(hapd_iface->bss[i]);
+					   hapd->conf->iface);
+				os_free(hapd);
+				hapd_iface->bss[i] = NULL;
 			}
 			os_free(hapd_iface->bss);
 		}
diff --git a/src/ap/hw_features.c b/src/ap/hw_features.c
index 7d36790..af1bc9b 100644
--- a/src/ap/hw_features.c
+++ b/src/ap/hw_features.c
@@ -982,8 +982,6 @@
 		hostapd_notify_bad_chans(iface);
 		return -3;
 	}
-
-	return 0;
 }
 
 
diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index 3e704e5..c97cef1 100644
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -1738,19 +1738,6 @@
 	u16 fc, stype;
 	int ret = 0;
 
-#ifdef CONFIG_TESTING_OPTIONS
-	if (hapd->ext_mgmt_frame_handling) {
-		size_t hex_len = 2 * len + 1;
-		char *hex = os_malloc(hex_len);
-		if (hex) {
-			wpa_snprintf_hex(hex, hex_len, buf, len);
-			wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-RX %s", hex);
-			os_free(hex);
-		}
-		return 1;
-	}
-#endif /* CONFIG_TESTING_OPTIONS */
-
 	if (len < 24)
 		return 0;
 
diff --git a/src/ap/ieee802_11_ht.c b/src/ap/ieee802_11_ht.c
index 31dc47e..a166178 100644
--- a/src/ap/ieee802_11_ht.c
+++ b/src/ap/ieee802_11_ht.c
@@ -139,7 +139,6 @@
 		op_mode_changes++;
 	}
 
-	new_op_mode = 0;
 	if (iface->num_sta_no_ht)
 		new_op_mode = OP_MODE_MIXED;
 	else if (iface->conf->secondary_channel && iface->num_sta_ht_20mhz)
diff --git a/src/ap/peerkey_auth.c b/src/ap/peerkey_auth.c
index ba5c606..612babc 100644
--- a/src/ap/peerkey_auth.c
+++ b/src/ap/peerkey_auth.c
@@ -221,8 +221,8 @@
 		return;
 
 	/* Peer RSN IE */
-	os_memcpy(buf, kde->rsn_ie, kde->rsn_ie_len);
-	pos = buf + kde->rsn_ie_len;
+	os_memcpy(pos, kde->rsn_ie, kde->rsn_ie_len);
+	pos += kde->rsn_ie_len;
 
 	/* Peer MAC Address */
 	pos = wpa_add_kde(pos, RSN_KEY_DATA_MAC_ADDR, peer, ETH_ALEN, NULL, 0);