diff --git a/Tethering/tests/integration/Android.bp b/Tethering/tests/integration/Android.bp
index 67e6f0d..f456273 100644
--- a/Tethering/tests/integration/Android.bp
+++ b/Tethering/tests/integration/Android.bp
@@ -82,6 +82,7 @@
         "libstaticjvmtiagent",
         // For NetworkStackUtils included in NetworkStackBase
         "libnetworkstackutilsjni",
+        "libtetherutilsjni",
     ],
     jarjar_rules: ":TetheringTestsJarJarRules",
     compile_multilib: "both",
diff --git a/tests/cts/hostside/app/src/com/android/cts/net/hostside/NetworkPolicyTestUtils.java b/tests/cts/hostside/app/src/com/android/cts/net/hostside/NetworkPolicyTestUtils.java
index e05fbea..b61535b 100644
--- a/tests/cts/hostside/app/src/com/android/cts/net/hostside/NetworkPolicyTestUtils.java
+++ b/tests/cts/hostside/app/src/com/android/cts/net/hostside/NetworkPolicyTestUtils.java
@@ -25,7 +25,6 @@
 
 import static com.android.compatibility.common.util.SystemUtil.runShellCommand;
 import static com.android.cts.net.hostside.AbstractRestrictBackgroundNetworkTestCase.TAG;
-import static com.android.cts.net.hostside.AbstractRestrictBackgroundNetworkTestCase.TEST_PKG;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
@@ -43,9 +42,11 @@
 import android.net.Network;
 import android.net.NetworkCapabilities;
 import android.net.wifi.WifiManager;
+import android.os.PersistableBundle;
 import android.os.Process;
+import android.telephony.CarrierConfigManager;
 import android.telephony.SubscriptionManager;
-import android.telephony.SubscriptionPlan;
+import android.telephony.data.ApnSetting;
 import android.text.TextUtils;
 import android.util.Log;
 
@@ -53,21 +54,24 @@
 
 import com.android.compatibility.common.util.AppStandbyUtils;
 import com.android.compatibility.common.util.BatteryUtils;
+import com.android.compatibility.common.util.ShellIdentityUtils;
 import com.android.compatibility.common.util.ThrowingRunnable;
 
-import java.time.Period;
-import java.time.ZonedDateTime;
-import java.util.Arrays;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 
 public class NetworkPolicyTestUtils {
 
+    // android.telephony.CarrierConfigManager.KEY_CARRIER_METERED_APN_TYPES_STRINGS
+    // TODO: Expose it as a @TestApi instead of copying the constant
+    private static final String KEY_CARRIER_METERED_APN_TYPES_STRINGS =
+            "carrier_metered_apn_types_strings";
+
     private static final int TIMEOUT_CHANGE_METEREDNESS_MS = 10_000;
 
     private static ConnectivityManager mCm;
     private static WifiManager mWm;
-    private static SubscriptionManager mSm;
+    private static CarrierConfigManager mCarrierConfigManager;
 
     private static Boolean mBatterySaverSupported;
     private static Boolean mDataSaverSupported;
@@ -216,17 +220,12 @@
     }
 
     private static void setCellularMeteredStatus(int subId, boolean metered) throws Exception {
-        setSubPlanOwner(subId, TEST_PKG);
-        try {
-            getSubscriptionManager().setSubscriptionPlans(subId,
-                    Arrays.asList(buildValidSubscriptionPlan(System.currentTimeMillis())));
-            final boolean unmeteredOverride = !metered;
-            getSubscriptionManager().setSubscriptionOverrideUnmetered(subId, unmeteredOverride,
-                    /*timeoutMillis=*/ 0);
-            assertActiveNetworkMetered(metered);
-        } finally {
-            setSubPlanOwner(subId, null);
-        }
+        final PersistableBundle bundle = new PersistableBundle();
+        bundle.putStringArray(KEY_CARRIER_METERED_APN_TYPES_STRINGS,
+                new String[] {ApnSetting.TYPE_MMS_STRING});
+        ShellIdentityUtils.invokeMethodWithShellPermissionsNoReturn(getCarrierConfigManager(),
+                (cm) -> cm.overrideConfig(subId, metered ? null : bundle));
+        assertActiveNetworkMetered(metered);
     }
 
     // Copied from cts/tests/tests/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -256,20 +255,6 @@
         }
     }
 
-    private static void setSubPlanOwner(int subId, String packageName) {
-        executeShellCommand("cmd netpolicy set sub-plan-owner " + subId + " " + packageName);
-    }
-
-    private static SubscriptionPlan buildValidSubscriptionPlan(long dataUsageTime) {
-        return SubscriptionPlan.Builder
-                .createRecurring(ZonedDateTime.parse("2007-03-14T00:00:00.000Z"),
-                        Period.ofMonths(1))
-                .setTitle("CTS")
-                .setDataLimit(1_000_000_000, SubscriptionPlan.LIMIT_BEHAVIOR_DISABLED)
-                .setDataUsage(500_000_000, dataUsageTime)
-                .build();
-    }
-
     public static void setRestrictBackground(boolean enabled) {
         executeShellCommand("cmd netpolicy set restrict-background " + enabled);
         final String output = executeShellCommand("cmd netpolicy get restrict-background");
@@ -339,12 +324,12 @@
         return mWm;
     }
 
-    public static SubscriptionManager getSubscriptionManager() {
-        if (mSm == null) {
-            mSm = (SubscriptionManager) getContext().getSystemService(
-                    Context.TELEPHONY_SUBSCRIPTION_SERVICE);
+    public static CarrierConfigManager getCarrierConfigManager() {
+        if (mCarrierConfigManager == null) {
+            mCarrierConfigManager = (CarrierConfigManager) getContext().getSystemService(
+                    Context.CARRIER_CONFIG_SERVICE);
         }
-        return mSm;
+        return mCarrierConfigManager;
     }
 
     public static Context getContext() {
diff --git a/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java b/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java
index 4668ba3..a663cd6 100755
--- a/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java
+++ b/tests/cts/hostside/app/src/com/android/cts/net/hostside/VpnTest.java
@@ -698,16 +698,30 @@
     }
 
     private class NeverChangeNetworkCallback extends NetworkCallback {
-        private volatile Network mLastNetwork;
+        private CountDownLatch mLatch = new CountDownLatch(1);
+        private volatile Network mFirstNetwork;
+        private volatile Network mOtherNetwork;
 
         public void onAvailable(Network n) {
-            assertNull("Callback got onAvailable more than once: " + mLastNetwork + ", " + n,
-                    mLastNetwork);
-            mLastNetwork = n;
+            // Don't assert here, as it crashes the test with a hard to debug message.
+            if (mFirstNetwork == null) {
+                mFirstNetwork = n;
+                mLatch.countDown();
+            } else if (mOtherNetwork == null) {
+                mOtherNetwork = n;
+            }
         }
 
-        public Network getLastNetwork() {
-            return mLastNetwork;
+        public Network getFirstNetwork() throws Exception {
+            assertTrue(
+                    "System default callback got no network after " + TIMEOUT_MS + "ms. "
+                    + "Please ensure the device has a working Internet connection.",
+                    mLatch.await(TIMEOUT_MS, TimeUnit.MILLISECONDS));
+            return mFirstNetwork;
+        }
+
+        public void assertNeverChanged() {
+            assertNull(mOtherNetwork);
         }
     }
 
@@ -753,13 +767,14 @@
 
         expectVpnTransportInfo(mCM.getActiveNetwork());
 
-        // Check that system default network callback has not seen any network changes, but the app
-        // default network callback has. This needs to be done before testing private DNS because
-        // checkStrictModePrivateDns will set the private DNS server to a nonexistent name, which
-        // will cause validation to fail could cause the default network to switch (e.g., from wifi
-        // to cellular).
-        assertEquals(defaultNetwork, neverChangeCallback.getLastNetwork());
+        // Check that system default network callback has not seen any network changes, even though
+        // the app's default network changed. This needs to be done before testing private
+        // DNS because checkStrictModePrivateDns will set the private DNS server to a nonexistent
+        // name, which will cause validation to fail and cause the default network to switch (e.g.,
+        // from wifi to cellular).
+        assertEquals(defaultNetwork, neverChangeCallback.getFirstNetwork());
         assertNotEqual(defaultNetwork, mCM.getActiveNetwork());
+        neverChangeCallback.assertNeverChanged();
         runWithShellPermissionIdentity(
                 () ->  mCM.unregisterNetworkCallback(neverChangeCallback),
                 NETWORK_SETTINGS);
diff --git a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
index 3145d7e..831810c 100644
--- a/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
+++ b/tests/cts/net/src/android/net/cts/ConnectivityManagerTest.java
@@ -195,7 +195,6 @@
     private PackageManager mPackageManager;
     private final HashMap<Integer, NetworkConfig> mNetworks =
             new HashMap<Integer, NetworkConfig>();
-    boolean mWifiWasDisabled;
     private UiAutomation mUiAutomation;
     private CtsNetUtils mCtsNetUtils;
 
@@ -207,7 +206,6 @@
         mWifiManager = (WifiManager) mContext.getSystemService(Context.WIFI_SERVICE);
         mPackageManager = mContext.getPackageManager();
         mCtsNetUtils = new CtsNetUtils(mContext);
-        mWifiWasDisabled = false;
 
         // Get com.android.internal.R.array.networkAttributes
         int resId = mContext.getResources().getIdentifier("networkAttributes", "array", "android");
@@ -230,10 +228,7 @@
 
     @After
     public void tearDown() throws Exception {
-        // Return WiFi to its original disabled state after tests that explicitly connect.
-        if (mWifiWasDisabled) {
-            mCtsNetUtils.disconnectFromWifi(null);
-        }
+        // Release any NetworkRequests filed to connect mobile data.
         if (mCtsNetUtils.cellConnectAttempted()) {
             mCtsNetUtils.disconnectFromCell();
         }
@@ -249,17 +244,6 @@
         }
     }
 
-    /**
-     * Make sure WiFi is connected to an access point if it is not already. If
-     * WiFi is enabled as a result of this function, it will be disabled
-     * automatically in tearDown().
-     */
-    private Network ensureWifiConnected() {
-        mWifiWasDisabled = !mWifiManager.isWifiEnabled();
-        // Even if wifi is enabled, the network may not be connected or ready yet
-        return mCtsNetUtils.connectToWifi();
-    }
-
     @Test
     public void testIsNetworkTypeValid() {
         assertTrue(ConnectivityManager.isNetworkTypeValid(ConnectivityManager.TYPE_MOBILE));
@@ -543,17 +527,20 @@
         Network wifiNetwork = null;
 
         try {
-            ensureWifiConnected();
+            mCtsNetUtils.ensureWifiConnected();
 
             // Now we should expect to get a network callback about availability of the wifi
             // network even if it was already connected as a state-based action when the callback
             // is registered.
             wifiNetwork = callback.waitForAvailable();
-            assertNotNull("Did not receive NetworkCallback.onAvailable for TRANSPORT_WIFI",
+            assertNotNull("Did not receive onAvailable for TRANSPORT_WIFI request",
                     wifiNetwork);
 
-            assertNotNull("Did not receive NetworkCallback.onAvailable for any default network",
+            assertNotNull("Did not receive onAvailable on default network callback",
                     defaultTrackingCallback.waitForAvailable());
+
+            assertNotNull("Did not receive onAvailable on system default network callback",
+                    systemDefaultTrackingCallback.waitForAvailable());
         } catch (InterruptedException e) {
             fail("Broadcast receiver or NetworkCallback wait was interrupted.");
         } finally {
@@ -596,7 +583,7 @@
         mCm.registerNetworkCallback(makeWifiNetworkRequest(), pendingIntent);
 
         try {
-            ensureWifiConnected();
+            mCtsNetUtils.ensureWifiConnected();
 
             // Now we expect to get the Intent delivered notifying of the availability of the wifi
             // network even if it was already connected as a state-based action when the callback
@@ -677,6 +664,17 @@
         return null;
     }
 
+    /**
+     * Checks that enabling/disabling wifi causes CONNECTIVITY_ACTION broadcasts.
+     */
+    @AppModeFull(reason = "Cannot get WifiManager in instant app mode")
+    @Test
+    public void testToggleWifiConnectivityAction() {
+        // toggleWifi calls connectToWifi and disconnectFromWifi, which both wait for
+        // CONNECTIVITY_ACTION broadcasts.
+        mCtsNetUtils.toggleWifi();
+    }
+
     /** Verify restricted networks cannot be requested. */
     @AppModeFull(reason = "CHANGE_NETWORK_STATE permission can't be granted to instant apps")
     @Test
@@ -804,7 +802,7 @@
     @Test
     public void testGetMultipathPreference() throws Exception {
         final ContentResolver resolver = mContext.getContentResolver();
-        ensureWifiConnected();
+        mCtsNetUtils.ensureWifiConnected();
         final String ssid = unquoteSSID(mWifiManager.getConnectionInfo().getSSID());
         final String oldMeteredSetting = getWifiMeteredStatus(ssid);
         final String oldMeteredMultipathPreference = Settings.Global.getString(
@@ -818,7 +816,7 @@
             waitForActiveNetworkMetered(TRANSPORT_WIFI, true);
             // Wifi meterness changes from unmetered to metered will disconnect and reconnect since
             // R.
-            final Network network = ensureWifiConnected();
+            final Network network = mCtsNetUtils.ensureWifiConnected();
             assertEquals(ssid, unquoteSSID(mWifiManager.getConnectionInfo().getSSID()));
             assertEquals(mCm.getNetworkCapabilities(network).hasCapability(
                     NET_CAPABILITY_NOT_METERED), false);
@@ -1032,7 +1030,7 @@
             return;
         }
 
-        final Network network = ensureWifiConnected();
+        final Network network = mCtsNetUtils.ensureWifiConnected();
         if (getSupportedKeepalivesForNet(network) != 0) return;
         final InetAddress srcAddr = getFirstV4Address(network);
         assumeTrue("This test requires native IPv4", srcAddr != null);
@@ -1052,7 +1050,7 @@
             return;
         }
 
-        final Network network = ensureWifiConnected();
+        final Network network = mCtsNetUtils.ensureWifiConnected();
         if (getSupportedKeepalivesForNet(network) == 0) return;
         final InetAddress srcAddr = getFirstV4Address(network);
         assumeTrue("This test requires native IPv4", srcAddr != null);
@@ -1263,7 +1261,7 @@
             return;
         }
 
-        final Network network = ensureWifiConnected();
+        final Network network = mCtsNetUtils.ensureWifiConnected();
         final int supported = getSupportedKeepalivesForNet(network);
         if (supported == 0) {
             return;
@@ -1360,7 +1358,7 @@
             return;
         }
 
-        final Network network = ensureWifiConnected();
+        final Network network = mCtsNetUtils.ensureWifiConnected();
         final int supported = getSupportedKeepalivesForNet(network);
         if (supported == 0) {
             return;
@@ -1408,7 +1406,7 @@
 
         // Ensure that NetworkUtils.queryUserAccess always returns false since this package should
         // not have netd system permission to call this function.
-        final Network wifiNetwork = ensureWifiConnected();
+        final Network wifiNetwork = mCtsNetUtils.ensureWifiConnected();
         assertFalse(NetworkUtils.queryUserAccess(Binder.getCallingUid(), wifiNetwork.netId));
 
         // Ensure that this package cannot bind to any restricted network that's currently
diff --git a/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java b/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
index 9eab024..8f2d93d 100644
--- a/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
+++ b/tests/cts/net/src/android/net/cts/Ikev2VpnTest.java
@@ -55,7 +55,7 @@
 import androidx.test.InstrumentationRegistry;
 
 import com.android.internal.util.HexDump;
-import com.android.org.bouncycastle.x509.X509V1CertificateGenerator;
+import com.android.internal.org.bouncycastle.x509.X509V1CertificateGenerator;
 import com.android.testutils.DevSdkIgnoreRule.IgnoreUpTo;
 import com.android.testutils.DevSdkIgnoreRunner;
 
diff --git a/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java b/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
index 0527011..88172d7 100644
--- a/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
+++ b/tests/cts/net/util/java/android/net/cts/util/CtsNetUtils.java
@@ -212,7 +212,7 @@
         mContext.registerReceiver(receiver, filter);
 
         boolean connected = false;
-        final String err = "Wifi must be configured to connect to an access point for this test.";
+        final String err = "Wifi must be configured to connect to an access point for this test";
         try {
             clearWifiBlacklist();
             SystemUtil.runShellCommand("svc wifi enable");
@@ -235,7 +235,7 @@
             }
             // Ensure we get an onAvailable callback and possibly a CONNECTIVITY_ACTION.
             wifiNetwork = callback.waitForAvailable();
-            assertNotNull(err, wifiNetwork);
+            assertNotNull(err + ": onAvailable callback not received", wifiNetwork);
             connected = !expectLegacyBroadcast || receiver.waitForState();
         } catch (InterruptedException ex) {
             fail("connectToWifi was interrupted");
@@ -244,7 +244,7 @@
             mContext.unregisterReceiver(receiver);
         }
 
-        assertTrue(err, connected);
+        assertTrue(err + ": CONNECTIVITY_ACTION not received", connected);
         return wifiNetwork;
     }