diff --git a/tests/cts/net/src/android/net/cts/DnsResolverTest.java b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
index 40d64cf..945f51d 100644
--- a/tests/cts/net/src/android/net/cts/DnsResolverTest.java
+++ b/tests/cts/net/src/android/net/cts/DnsResolverTest.java
@@ -144,9 +144,8 @@
         private DnsAnswer mDnsAnswer;
 
         VerifyCancelCallback(@NonNull String msg, @Nullable CancellationSignal cancel) {
-            this.mMsg = msg;
-            this.mCancelSignal = cancel;
-            this.mDnsAnswer = null;
+            mMsg = msg;
+            mCancelSignal = cancel;
         }
 
         VerifyCancelCallback(@NonNull String msg) {
@@ -187,15 +186,15 @@
         }
 
         private void assertValidAnswer() {
-            assertTrue(mMsg + "No valid answer", mDnsAnswer != null);
-            assertTrue(mMsg + " Unexpected error: reported rcode" + mRcode +
-                    " blob's rcode " + mDnsAnswer.getRcode(), mRcode == mDnsAnswer.getRcode());
+            assertNotNull(mMsg + " No valid answer", mDnsAnswer);
+            assertEquals(mMsg + " Unexpected error: reported rcode" + mRcode +
+                    " blob's rcode " + mDnsAnswer.getRcode(), mRcode, mDnsAnswer.getRcode());
         }
 
         public void assertHasAnswer() {
             assertValidAnswer();
             // Check rcode field.(0, No error condition).
-            assertTrue(mMsg + " Response error, rcode: " + mRcode, mRcode == 0);
+            assertEquals(mMsg + " Response error, rcode: " + mRcode, mRcode, 0);
             // Check answer counts.
             assertGreaterThan(mMsg + " No answer found", mDnsAnswer.getANCount(), 0);
             // Check question counts.
@@ -205,9 +204,9 @@
         public void assertNXDomain() {
             assertValidAnswer();
             // Check rcode field.(3, NXDomain).
-            assertTrue(mMsg + " Unexpected rcode: " + mRcode, mRcode == NXDOMAIN);
+            assertEquals(mMsg + " Unexpected rcode: " + mRcode, mRcode, NXDOMAIN);
             // Check answer counts. Expect 0 answer.
-            assertTrue(mMsg + " Not an empty answer", mDnsAnswer.getANCount() == 0);
+            assertEquals(mMsg + " Not an empty answer", mDnsAnswer.getANCount(), 0);
             // Check question counts.
             assertGreaterThan(mMsg + " No question found", mDnsAnswer.getQDCount(), 0);
         }
@@ -215,9 +214,9 @@
         public void assertEmptyAnswer() {
             assertValidAnswer();
             // Check rcode field.(0, No error condition).
-            assertTrue(mMsg + " Response error, rcode: " + mRcode, mRcode == 0);
+            assertEquals(mMsg + " Response error, rcode: " + mRcode, mRcode, 0);
             // Check answer counts. Expect 0 answer.
-            assertTrue(mMsg + " Not an empty answer", mDnsAnswer.getANCount() == 0);
+            assertEquals(mMsg + " Not an empty answer", mDnsAnswer.getANCount(), 0);
             // Check question counts.
             assertGreaterThan(mMsg + " No question found", mDnsAnswer.getQDCount(), 0);
         }
@@ -279,10 +278,10 @@
             try {
                 assertTrue(msg + " but no answer after " + TIMEOUT_MS + "ms.",
                         callback.waitForAnswer());
-                // Except no answer record because of querying with empty dname(ROOT)
+                // Except no answer record because the root does not have AAAA records.
                 callback.assertEmptyAnswer();
             } catch (InterruptedException e) {
-                fail(msg + "Waiting for DNS lookup was interrupted");
+                fail(msg + " Waiting for DNS lookup was interrupted");
             }
         }
     }
@@ -331,7 +330,7 @@
                     assertTrue(msg + " query was not cancelled",
                             latch.await(TIMEOUT_MS, TimeUnit.MILLISECONDS));
                 } catch (InterruptedException e) {
-                    fail(msg + "Waiting for DNS lookup was interrupted");
+                    fail(msg + " Waiting for DNS lookup was interrupted");
                 }
             } while (retry);
         }
@@ -508,7 +507,7 @@
                     assertTrue(msg + " query was not cancelled",
                             latch.await(TIMEOUT_MS, TimeUnit.MILLISECONDS));
                 } catch (InterruptedException e) {
-                    fail(msg + "Waiting for DNS lookup was interrupted");
+                    fail(msg + " Waiting for DNS lookup was interrupted");
                 }
             } while (retry);
         }
diff --git a/tests/cts/net/src/android/net/cts/IpSecManagerTunnelTest.java b/tests/cts/net/src/android/net/cts/IpSecManagerTunnelTest.java
index 93638ac..ef6bfc0 100644
--- a/tests/cts/net/src/android/net/cts/IpSecManagerTunnelTest.java
+++ b/tests/cts/net/src/android/net/cts/IpSecManagerTunnelTest.java
@@ -59,6 +59,7 @@
 import android.os.IBinder;
 import android.os.ParcelFileDescriptor;
 import android.os.SystemProperties;
+import android.platform.test.annotations.AppModeFull;
 
 import androidx.test.InstrumentationRegistry;
 import androidx.test.runner.AndroidJUnit4;
@@ -79,6 +80,7 @@
 import org.junit.runner.RunWith;
 
 @RunWith(AndroidJUnit4.class)
+@AppModeFull(reason = "MANAGE_TEST_NETWORKS permission can't be granted to instant apps")
 public class IpSecManagerTunnelTest extends IpSecBaseTest {
     private static final String TAG = IpSecManagerTunnelTest.class.getSimpleName();
 
diff --git a/tests/cts/net/src/android/net/wifi/cts/WifiManagerTest.java b/tests/cts/net/src/android/net/wifi/cts/WifiManagerTest.java
index 7576450..d8c7dc8 100644
--- a/tests/cts/net/src/android/net/wifi/cts/WifiManagerTest.java
+++ b/tests/cts/net/src/android/net/wifi/cts/WifiManagerTest.java
@@ -40,6 +40,7 @@
 import android.provider.Settings;
 import android.support.test.uiautomator.UiDevice;
 import android.test.AndroidTestCase;
+import android.text.TextUtils;
 import android.util.ArraySet;
 import android.util.Log;
 
@@ -798,6 +799,8 @@
      * functionality.  The permission is intended to be granted to only the device setup wizard.
      */
     public void testNetworkSetupWizardPermission() {
+        final ArraySet<String> allowedPackages = new ArraySet();
+
         final PackageManager pm = getContext().getPackageManager();
 
         final Intent intent = new Intent(Intent.ACTION_MAIN);
@@ -805,16 +808,39 @@
         final ResolveInfo ri = pm.resolveActivity(intent, PackageManager.MATCH_DISABLED_COMPONENTS);
         String validPkg = "";
         if (ri != null) {
+            allowedPackages.add(ri.activityInfo.packageName);
             validPkg = ri.activityInfo.packageName;
         }
 
-        final List<PackageInfo> holding = pm.getPackagesHoldingPermissions(new String[] {
-                android.Manifest.permission.NETWORK_SETUP_WIZARD
+        final Intent preIntent = new Intent("com.android.setupwizard.OEM_PRE_SETUP");
+        preIntent.addCategory(Intent.CATEGORY_DEFAULT);
+        final ResolveInfo preRi = pm
+            .resolveActivity(preIntent, PackageManager.MATCH_DISABLED_COMPONENTS);
+        String prePackageName = "";
+        if (null != preRi) {
+            prePackageName = preRi.activityInfo.packageName;
+        }
+
+        final Intent postIntent = new Intent("com.android.setupwizard.OEM_POST_SETUP");
+        postIntent.addCategory(Intent.CATEGORY_DEFAULT);
+        final ResolveInfo postRi = pm
+            .resolveActivity(postIntent, PackageManager.MATCH_DISABLED_COMPONENTS);
+        String postPackageName = "";
+        if (null != postRi) {
+            postPackageName = postRi.activityInfo.packageName;
+        }
+        if (!TextUtils.isEmpty(prePackageName) && !TextUtils.isEmpty(postPackageName)
+            && prePackageName.equals(postPackageName)) {
+            allowedPackages.add(prePackageName);
+        }
+
+        final List<PackageInfo> holding = pm.getPackagesHoldingPermissions(new String[]{
+            android.Manifest.permission.NETWORK_SETUP_WIZARD
         }, PackageManager.MATCH_UNINSTALLED_PACKAGES);
         for (PackageInfo pi : holding) {
-            if (!Objects.equals(pi.packageName, validPkg)) {
+            if (!allowedPackages.contains(pi.packageName)) {
                 fail("The NETWORK_SETUP_WIZARD permission must not be held by " + pi.packageName
-                    + " and must be revoked for security reasons [" + validPkg +"]");
+                    + " and must be revoked for security reasons [" + validPkg + "]");
             }
         }
     }