diff --git a/lib/ovsdb/ovsdb_table.c b/lib/ovsdb/ovsdb_table.c
index 3dc783bfd..e497354eb 100644
--- a/lib/ovsdb/ovsdb_table.c
+++ b/lib/ovsdb/ovsdb_table.c
@@ -197,7 +197,7 @@ void* onewifi_ovsdb_table_select_where(const char *ovsdb_sock_path, ovsdb_table_
     if (!retval && records_array)
         free(records_array);
     json_decref(jrows);
-    return records_array;
+    return retval;
 }
 
 void* onewifi_ovsdb_table_select(const char *ovsdb_sock_path, ovsdb_table_t *table, char *column, char *value, int *count)
diff --git a/source/apps/levl/wifi_levl.c b/source/apps/levl/wifi_levl.c
index 265fca68f..8cbd9fd71 100644
--- a/source/apps/levl/wifi_levl.c
+++ b/source/apps/levl/wifi_levl.c
@@ -1865,7 +1865,7 @@ bus_error_t levl_event_handler(char *eventName, bus_event_sub_action_t action, i
                 return bus_error_general;
             }
 
-            if ((radio < 0) || (radio > MAX_NUM_RADIOS)) {
+            if ((radio < 1) || (radio > MAX_NUM_RADIOS)) {
                 wifi_util_dbg_print(WIFI_APPS, "%s:%d Invalid Radio: %u\n", __func__, __LINE__, radio-1);
                 pthread_mutex_unlock(&wifi_app->data.u.levl.lock);
                 return bus_error_general;
diff --git a/source/core/services/vap_svc_mesh_ext.c b/source/core/services/vap_svc_mesh_ext.c
index d2a74fcf3..7567f195b 100644
--- a/source/core/services/vap_svc_mesh_ext.c
+++ b/source/core/services/vap_svc_mesh_ext.c
@@ -1722,8 +1722,13 @@ void process_ext_connected_scan_results(vap_svc_t *svc, void *arg)
     convert_radio_index_to_freq_band(svc->prop, results->radio_index, (int *)&band);
     if ((ext->candidates_list.scan_list == NULL) && num) {
         ext->candidates_list.scan_list = (bss_candidate_t *) malloc(num * sizeof(bss_candidate_t));
+        if (ext->candidates_list.scan_list == NULL) {
+            ext_set_conn_state(ext, connection_state_connected, __func__, __LINE__);
+            schedule_connect_sm(svc);
+            return;
+        }
         scan_list = ext->candidates_list.scan_list;
-        ext->candidates_list.scan_count = num;
+        ext->candidates_list.scan_count = 0;
     } else  {
         wifi_util_dbg_print(WIFI_CTRL, "%s:%d NULL scan list should not reach this condition\n", __func__, __LINE__);
         ext_set_conn_state(ext, connection_state_connected, __func__, __LINE__);
@@ -1741,6 +1746,7 @@ void process_ext_connected_scan_results(vap_svc_t *svc, void *arg)
             scan_list->conn_retry_attempt = 0;
             scan_list->radio_freq_band = band;
             scan_list++;
+            ext->candidates_list.scan_count++;
         }
         tmp_bss++;
     }
diff --git a/source/core/wifi_ctrl_rbus_handlers.c b/source/core/wifi_ctrl_rbus_handlers.c
index da794fbf1..ec5b883a7 100644
--- a/source/core/wifi_ctrl_rbus_handlers.c
+++ b/source/core/wifi_ctrl_rbus_handlers.c
@@ -3466,6 +3466,8 @@ bus_error_t ap_get_handler(char *name, raw_data_t *p_data, bus_user_data_t *user
             if (p_data->raw_data.bytes == NULL) {
                 wifi_util_error_print(WIFI_CTRL,"%s:%d memory allocation is failed:%d\r\n",__func__,
                     __LINE__, str_len);
+                free(harvester_buf[vap_array_index]);
+                harvester_buf[vap_array_index] = NULL;
                 pthread_mutex_unlock(&events_bus_data->events_bus_lock);
                 return bus_error_out_of_resources;
             }
diff --git a/source/core/wifi_ctrl_webconfig.c b/source/core/wifi_ctrl_webconfig.c
index 826eaa232..3b6a9d2bf 100644
--- a/source/core/wifi_ctrl_webconfig.c
+++ b/source/core/wifi_ctrl_webconfig.c
@@ -3514,9 +3514,9 @@ void start_station_vaps(bool is_private, bool rf_status)
         str = data->u.encoded.raw;
         push_event_to_ctrl_queue(str, strlen(str), wifi_event_type_webconfig,
             wifi_event_webconfig_set_data_dml, NULL);
-    } else {
-        webconfig_data_free(data);
     }
+
+    webconfig_data_free(data);
     free(data);
 }
 
diff --git a/source/core/wifi_passpoint.c b/source/core/wifi_passpoint.c
index 80a02bbe2..bacd948ac 100644
--- a/source/core/wifi_passpoint.c
+++ b/source/core/wifi_passpoint.c
@@ -719,10 +719,11 @@ INT WiFi_SetGasConfig(char *JSON_STR)
         return RETURN_OK;
       }
       wifi_util_dbg_print(WIFI_PASSPOINT,"Failed to update HAL with GAS Config. Adv-ID:%d\n",gasConfig_struct.AdvertisementID);
+      cJSON_Delete(passPointCfg);
       return RETURN_ERR;
 #else
     UNREFERENCED_PARAMETER(JSON_STR);
-#endif 
+#endif
     return RETURN_ERR;
 }
 
diff --git a/source/db/wifi_db_apis.c b/source/db/wifi_db_apis.c
index 58ed61652..8e6288066 100644
--- a/source/db/wifi_db_apis.c
+++ b/source/db/wifi_db_apis.c
@@ -2508,23 +2508,26 @@ int wifidb_get_wifi_security_config(char *vap_name, wifi_vap_security_t *sec)
 
     where = onewifi_ovsdb_tran_cond(OCLM_STR, "vap_name", OFUNC_EQ, vap_name);
     pcfg = onewifi_ovsdb_table_select_where(g_wifidb->wifidb_sock_path, &table_Wifi_Security_Config, where, &count);
-    if (pcfg == NULL) {
+    if (pcfg == NULL || count == 0) {
         wifidb_print("%s:%d Table table_Wifi_Security_Config table not found, entry count=%d \n",__func__, __LINE__, count);
         return -1;
     }
     vap_index = convert_vap_name_to_array_index(&((wifi_mgr_t*)get_wifimgr_obj())->hal_cap.wifi_prop, vap_name);
     if(vap_index < 0) {
         wifi_util_dbg_print(WIFI_DB,"%s:%d: %s vap_name is invalid\n",__func__, __LINE__,vap_name);
+        free(pcfg);
         return -1;
     }
 
     radio_index = convert_vap_name_to_radio_array_index(&((wifi_mgr_t*)get_wifimgr_obj())->hal_cap.wifi_prop, vap_name);
     if(radio_index < 0) {
         wifi_util_dbg_print(WIFI_DB,"%s:%d: %s vap_name is invalid\n",__func__, __LINE__,vap_name);
+        free(pcfg);
         return -1;
     }
     if (convert_radio_index_to_freq_band(&((wifi_mgr_t*)get_wifimgr_obj())->hal_cap.wifi_prop, radio_index, &band) != RETURN_OK) {
         wifi_util_error_print(WIFI_DB, "%s:%d: Unable to fetch proper band\n", __func__, __LINE__);
+        free(pcfg);
         return -1;
     }
     
@@ -6579,18 +6582,21 @@ int wifidb_get_wifi_vap_info(char *vap_name, wifi_vap_info_t *config,
         if((convert_radio_name_to_index(&index,pcfg->radio_name))!=0)
         {
             wifi_util_dbg_print(WIFI_DB,"%s:%d: %s invalid radio name \n",__func__, __LINE__,pcfg->radio_name);
+            free(pcfg);
             return RETURN_ERR;
         }
         config->radio_index = index ;
         config->vap_index = convert_vap_name_to_index(&((wifi_mgr_t*) get_wifimgr_obj())->hal_cap.wifi_prop, pcfg->vap_name);
         if ((int)config->vap_index < 0) {
             wifi_util_error_print(WIFI_DB,"%s:%d: %s invalid vap name \n",__func__, __LINE__,pcfg->vap_name);
+            free(pcfg);
             return RETURN_ERR;
         }
         strncpy(config->vap_name, pcfg->vap_name,(sizeof(config->vap_name)-1));
         vap_index = convert_vap_name_to_index(&((wifi_mgr_t*) get_wifimgr_obj())->hal_cap.wifi_prop, pcfg->vap_name);
         if ((int)vap_index < 0) {
             wifi_util_error_print(WIFI_DB,"%s:%d: %s invalid vap name \n",__func__, __LINE__,pcfg->vap_name);
+            free(pcfg);
             return RETURN_ERR;
         }
         if (isVapLnfPsk(vap_index) && pcfg->mdu_enabled) {
@@ -6700,7 +6706,7 @@ int wifidb_get_wifi_security_config_old_mode(char *vap_name, int vap_index)
     where = onewifi_ovsdb_tran_cond(OCLM_STR, "vap_name", OFUNC_EQ, vap_name);
     pcfg = onewifi_ovsdb_table_select_where(g_wifidb->wifidb_sock_path, &table_Wifi_Security_Config, where, &count);
 
-    if (pcfg == NULL) {
+    if (pcfg == NULL || count == 0) {
         wifidb_print("%s:%d Table table_Wifi_Security_Config table not found, entry count=%d \n",__func__, __LINE__, count);
 #if defined(CONFIG_IEEE80211BE)
         if(is_6g)
@@ -6713,6 +6719,7 @@ int wifidb_get_wifi_security_config_old_mode(char *vap_name, int vap_index)
 #if defined(CONFIG_IEEE80211BE)
     sec_mode_old = (is_6g && !pcfg->security_mode) ? wifi_security_mode_wpa3_personal : pcfg->security_mode;
 #endif /* CONFIG_IEEE80211BE */
+    free(pcfg);
     return sec_mode_old;
 }
 
diff --git a/source/dml/tr_181/ml/cosa_wifi_dml.c b/source/dml/tr_181/ml/cosa_wifi_dml.c
index 255422130..2c693ec3d 100755
--- a/source/dml/tr_181/ml/cosa_wifi_dml.c
+++ b/source/dml/tr_181/ml/cosa_wifi_dml.c
@@ -20525,6 +20525,7 @@ InterworkingService_SetParamStringValue
                 wifi_util_dbg_print(WIFI_DMCLI,"%s:%d Invalid json for vap %s\n", __FUNCTION__,__LINE__,pcfg->vap_name);
                 return FALSE;
             }
+            cJSON_Delete(p_root);
             if (strnlen(pString, sizeof(vapInfo->u.bss_info.interworking.anqp.anqpParameters)) < sizeof(vapInfo->u.bss_info.interworking.anqp.anqpParameters))
             {
                 AnscCopyString((char*)vapInfo->u.bss_info.interworking.anqp.anqpParameters,(char*)pString);
@@ -20816,6 +20817,8 @@ Passpoint_SetParamBoolValue
             CcspTraceWarning(("Cannot Enable Passpoint. RFC Disabled\n"));
             return FALSE;
         }
+        ((CCSP_MESSAGE_BUS_INFO *)bus_handle)->freefunc(strValue);
+        strValue = NULL;
 
         if(false == vapInfo->u.bss_info.interworking.interworking.interworkingEnabled){
             CcspTraceWarning(("Cannot Enable Passpoint. Interworking Disabled\n"));
@@ -20897,6 +20900,7 @@ Passpoint_SetParamStringValue
                 wifi_util_dbg_print(WIFI_DMCLI,"%s:%d Invalid json for vap %s\n", __FUNCTION__,__LINE__,pcfg->vap_name);
                 return FALSE;
             }
+            cJSON_Delete(p_root);
             if (strnlen(pString, sizeof(vapInfo->u.bss_info.interworking.passpoint.hs2Parameters)) < sizeof(vapInfo->u.bss_info.interworking.passpoint.hs2Parameters))
             {
                 AnscCopyString((char*)vapInfo->u.bss_info.interworking.passpoint.hs2Parameters,pString);
@@ -20904,7 +20908,6 @@ Passpoint_SetParamStringValue
             else
             {
                 wifi_util_dbg_print(WIFI_DMCLI,"%s:%d Input string too long for vap %s\n", __FUNCTION__, __LINE__, pcfg->vap_name);
-                cJSON_Delete(p_root);
                 return FALSE;
             }
 	    set_dml_cache_vap_config_changed(instance_number - 1);
diff --git a/source/services/mesh/wifi_service_mesh.c b/source/services/mesh/wifi_service_mesh.c
index b99b49b37..a0c17e786 100644
--- a/source/services/mesh/wifi_service_mesh.c
+++ b/source/services/mesh/wifi_service_mesh.c
@@ -1057,8 +1057,14 @@ void process_ext_connected_scan_results(wifi_service_node_t *node, wifi_core_dat
     convert_radio_index_to_freq_band(&node->cap->wifi_prop, results->radio_index, (int *)&band);
     if ((ext->candidates_list.scan_list == NULL) && num) {
         ext->candidates_list.scan_list = (bss_candidate_t *) malloc(num * sizeof(bss_candidate_t));
+        if (ext->candidates_list.scan_list == NULL) {
+            ext_set_conn_state(ext, connection_state_connected, __func__, __LINE__);
+            scheduler_add_timer_task(ctrl->sched, FALSE, &ext->ext_connect_algo_processor_id,
+                        process_ext_connect_algorithm, node,
+                        EXT_CONNECT_ALGO_PROCESSOR_INTERVAL, 1, FALSE);
+            return;
+        }
         scan_list = ext->candidates_list.scan_list;
-        ext->candidates_list.scan_count = num;
     } else  {
         wifi_util_dbg_print(WIFI_SERVICES, "%s:%d NULL scan list should not reach this condition\n", __func__, __LINE__);
         ext_set_conn_state(ext, connection_state_connected, __func__, __LINE__);
@@ -1081,10 +1087,13 @@ void process_ext_connected_scan_results(wifi_service_node_t *node, wifi_core_dat
         }
         tmp_bss++;
     }
+    ext->candidates_list.scan_count = scan_list - ext->candidates_list.scan_list;
 
     if (found_candidate) {
         ext_set_conn_state(ext, connection_state_disconnection_in_progress, __func__, __LINE__);
     } else {
+        free(ext->candidates_list.scan_list);
+        ext->candidates_list.scan_list = NULL;
         ext_set_conn_state(ext, connection_state_connected, __func__, __LINE__);
     }
     scheduler_add_timer_task(ctrl->sched, FALSE, &ext->ext_connect_algo_processor_id,