diff --git a/src/clu_main.c b/src/clu_main.c
index 4aa64fb8..4f904c55 100644
--- a/src/clu_main.c
+++ b/src/clu_main.c
@@ -382,7 +382,7 @@ int clu_entry(const void* argument)
 {
 
     HAL_StatusTypeDef halRet;
-    byte buffer[50];
+    byte buffer[51] = {0};
 
     char* command;
     char* token;
@@ -397,7 +397,7 @@ int clu_entry(const void* argument)
 
     /* Recieve the command from the UART console */
     do {
-        halRet = HAL_UART_Receive(&HAL_CONSOLE_UART, buffer, sizeof(buffer), 100);
+        halRet = HAL_UART_Receive(&HAL_CONSOLE_UART, buffer, (sizeof(buffer)-1), 100);
     } while (halRet != HAL_OK || buffer[0] == '\n' || buffer[0] == '\r');
 
     WOLFCLU_LOG(WOLFCLU_L0, "Command received.");
diff --git a/src/ocsp/clu_ocsp.c b/src/ocsp/clu_ocsp.c
index 6b49e3d5..48c8d420 100644
--- a/src/ocsp/clu_ocsp.c
+++ b/src/ocsp/clu_ocsp.c
@@ -23,6 +23,7 @@
 #include <wolfclu/clu_log.h>
 #include <wolfclu/clu_optargs.h>
 #include <wolfclu/clu_error_codes.h>
+#include <wolfssl/wolfcrypt/asn.h>
 
 #if defined(HAVE_OCSP) && defined(HAVE_OCSP_RESPONDER)
 
@@ -804,6 +805,7 @@ static int ocspResponder(OcspResponderConfig* config)
         const byte* ocspReq;
         int ocspReqSz;
         word32 respSz;
+        enum Ocsp_Response_Status ocspStatus = OCSP_SUCCESSFUL;
 
         /* Accept connection */
         clientfd = wolfCLU_ServerAccept(sockfd);
@@ -821,30 +823,29 @@ static int ocspResponder(OcspResponderConfig* config)
                 respBuffer, &respSz);
 
         if (ret != 0) {
-            enum Ocsp_Response_Status errStatus;
 
             /* Map error to OCSP response status */
             switch (ret) {
                 case ASN_PARSE_E:
-                    errStatus = OCSP_MALFORMED_REQUEST;
+                    ocspStatus = OCSP_MALFORMED_REQUEST;
                     break;
                 case ASN_SIG_HASH_E:
-                    errStatus = OCSP_INTERNAL_ERROR;
+                    ocspStatus = OCSP_INTERNAL_ERROR;
                     break;
                 case ASN_NO_SIGNER_E:
-                    errStatus = OCSP_UNAUTHORIZED;
+                    ocspStatus = OCSP_UNAUTHORIZED;
                     break;
                 case OCSP_CERT_UNKNOWN:
-                    errStatus = OCSP_UNAUTHORIZED;
+                    ocspStatus = OCSP_UNAUTHORIZED;
                     break;
                 default:
-                    errStatus = OCSP_INTERNAL_ERROR;
+                    ocspStatus = OCSP_INTERNAL_ERROR;
                     break;
             }
 
             /* Generate OCSP error response */
             respSz = sizeof(respBuffer);
-            ret = wc_OcspResponder_WriteErrorResponse(errStatus, respBuffer, &respSz);
+            ret = wc_OcspResponder_WriteErrorResponse(ocspStatus, respBuffer, &respSz);
 
             if (ret != 0) {
                 /* If we can't encode an error response, send HTTP/SCGI error */
@@ -857,10 +858,12 @@ static int ocspResponder(OcspResponderConfig* config)
         if (transportSendResponse(clientfd, transportType, respBuffer, (int)respSz) != 0)
             goto continue_loop;
 
-        /* Only count successfully processed requests toward the -nrequest
-         * limit. Failed reads/sends jump to continue_loop above, so a
-         * misbehaving client cannot exhaust the budget. */
-        requestsProcessed++;
+        if (ocspStatus == OCSP_SUCCESSFUL) {
+            /* Only count successfully processed requests toward the -nrequest
+             * limit. Failed reads/sends jump to continue_loop above, so a
+             * misbehaving client cannot exhaust the budget. */
+            requestsProcessed++;
+        }
 
         /* Check if we've hit the request limit */
         if (config->nrequest > 0 && requestsProcessed >= config->nrequest) {
diff --git a/src/pkcs/clu_pkcs12.c b/src/pkcs/clu_pkcs12.c
index 4bd09634..7da29c5c 100644
--- a/src/pkcs/clu_pkcs12.c
+++ b/src/pkcs/clu_pkcs12.c
@@ -59,7 +59,7 @@ static void wolfCLU_pKeyHelp(void)
 int wolfCLU_PKCS12(int argc, char** argv)
 {
 #if defined(HAVE_PKCS12) && !defined(WOLFCLU_NO_FILESYSTEM)
-    char password[MAX_PASSWORD_SIZE];
+    char password[MAX_PASSWORD_SIZE] = "";
     int passwordSz = MAX_PASSWORD_SIZE;
     int ret    = WOLFCLU_SUCCESS;
     int useDES = 1;     /* default to yes */
diff --git a/src/x509/clu_x509_sign.c b/src/x509/clu_x509_sign.c
index 34b51ef3..51286c09 100644
--- a/src/x509/clu_x509_sign.c
+++ b/src/x509/clu_x509_sign.c
@@ -1376,7 +1376,7 @@ int wolfCLU_CertSign(WOLFCLU_CERT_SIGN* csign, WOLFSSL_X509* x509)
 
     /* set extensions */
     if (ret == WOLFCLU_SUCCESS && csign->ext != NULL) {
-        wolfCLU_setExtensions(x509, csign->config, csign->ext);
+        ret = wolfCLU_setExtensions(x509, csign->config, csign->ext);
     }
 
     /* sign the certificate */