diff --git a/components/bt/host/bluedroid/bta/av/bta_av_act.c b/components/bt/host/bluedroid/bta/av/bta_av_act.c
index 4feb33e242..434dfa8b22 100644
--- a/components/bt/host/bluedroid/bta/av/bta_av_act.c
+++ b/components/bt/host/bluedroid/bta/av/bta_av_act.c
@@ -1192,16 +1192,16 @@ void bta_av_conn_chg(tBTA_AV_DATA *p_data)
             }
         }
     } else {
-        if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt) {
-            bta_sys_conn_close(TSEP_TO_SYS_ID(p_scb->seps[p_scb->sep_idx].tsep), bta_av_cb.audio_open_cnt, p_scb->peer_addr);
-            /* this channel is still marked as open. decrease the count */
-            bta_av_cb.audio_open_cnt--;
-        }
-
-        /* clear the conned mask for this channel */
-        p_cb->conn_audio &= ~mask;
-        p_cb->conn_video &= ~mask;
         if (p_scb) {
+            if ((p_cb->conn_audio & mask) && bta_av_cb.audio_open_cnt) {
+                bta_sys_conn_close(TSEP_TO_SYS_ID(p_scb->seps[p_scb->sep_idx].tsep), bta_av_cb.audio_open_cnt, p_scb->peer_addr);
+                /* this channel is still marked as open. decrease the count */
+                bta_av_cb.audio_open_cnt--;
+            }
+            /* clear the conned mask for this channel */
+            p_cb->conn_audio &= ~mask;
+            p_cb->conn_video &= ~mask;
+
             /* the stream is closed.
              * clear the peer address, so it would not mess up the AVRCP for the next round of operation */
             bdcpy(p_scb->peer_addr, bd_addr_null);
diff --git a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c
index 1c95371afa..724ea7c67a 100644
--- a/components/bt/host/bluedroid/bta/dm/bta_dm_act.c
+++ b/components/bt/host/bluedroid/bta/dm/bta_dm_act.c
@@ -2348,7 +2348,7 @@ void bta_dm_search_result (tBTA_DM_MSG *p_data)
 
     /* call back if application wants name discovery or found services that application is searching */
     if (( !bta_dm_search_cb.services )
-            || (( bta_dm_search_cb.services ) && ( p_data->disc_result.result.disc_res.services ))) {
+            || ( p_data->disc_result.result.disc_res.services )) {
         bta_dm_search_cb.p_search_cback(BTA_DM_DISC_RES_EVT, &p_data->disc_result.result);
     }
 
diff --git a/components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c b/components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c
index c85c00c3fb..07ebff2877 100644
--- a/components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c
+++ b/components/bt/host/bluedroid/bta/gatt/bta_gattc_act.c
@@ -2037,7 +2037,7 @@ BOOLEAN bta_gattc_process_srvc_chg_ind(UINT16 conn_id,
         if ( ++ p_srcb->update_count == bta_gattc_num_reg_app()) {
             /* not an opened connection; or connection busy */
             /* search for first available clcb and start discovery */
-            if (p_clcb == NULL || (p_clcb && p_clcb->p_q_cmd != NULL)) {
+            if ((p_clcb == NULL) || (p_clcb->p_q_cmd != NULL)) {
                 for (i = 0 ; i < BTA_GATTC_CLCB_MAX; i ++) {
                     if (bta_gattc_cb.clcb[i].in_use &&
                             bta_gattc_cb.clcb[i].p_srcb == p_srcb &&
diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c
index ad8c80b1fb..f3bf70e80c 100644
--- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c
+++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_sco.c
@@ -1405,14 +1405,8 @@ BOOLEAN bta_ag_sco_is_open(tBTA_AG_SCB *p_scb)
 *******************************************************************************/
 BOOLEAN bta_ag_sco_is_opening(tBTA_AG_SCB *p_scb)
 {
-#if (BTM_WBS_INCLUDED == TRUE )
-    return (((bta_ag_cb.sco.state == BTA_AG_SCO_OPENING_ST) ||
-            (bta_ag_cb.sco.state == BTA_AG_SCO_OPENING_ST)) &&
-            (bta_ag_cb.sco.p_curr_scb == p_scb));
-#else
     return ((bta_ag_cb.sco.state == BTA_AG_SCO_OPENING_ST) &&
             (bta_ag_cb.sco.p_curr_scb == p_scb));
-#endif
 }
 
 /*******************************************************************************
diff --git a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c
index 29276fdb3d..169c14dfbf 100644
--- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c
+++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_at.c
@@ -1836,7 +1836,7 @@ void bta_hf_client_send_at_bia(void)
     for (i = 0; i < BTA_HF_CLIENT_AT_INDICATOR_COUNT; i++) {
         int sup = bta_hf_client_cb.scb.at_cb.indicator_lookup[i] == -1 ? 0 : 1;
 
-        at_len += snprintf(buf + at_len, BTA_HF_CLIENT_AT_MAX_LEN - at_len, "%u,", sup);
+        at_len += snprintf(buf + at_len, BTA_HF_CLIENT_AT_MAX_LEN - at_len, "%d,", sup);
     }
 
     buf[at_len - 1] = '\r';
diff --git a/components/bt/host/bluedroid/bta/jv/bta_jv_act.c b/components/bt/host/bluedroid/bta/jv/bta_jv_act.c
index 88bd0eb842..492c22022e 100644
--- a/components/bt/host/bluedroid/bta/jv/bta_jv_act.c
+++ b/components/bt/host/bluedroid/bta/jv/bta_jv_act.c
@@ -2941,7 +2941,9 @@ void bta_jv_l2cap_connect_le(tBTA_JV_MSG *p_data)
     if (call_init_f) {
         cc->p_cback(BTA_JV_L2CAP_CL_INIT_EVT, &evt, cc->user_data);
     }
-    t->init_called = TRUE;
+    if (t) {
+        t->init_called = TRUE;
+    }
 }
 
 
diff --git a/components/bt/host/bluedroid/bta/jv/bta_jv_api.c b/components/bt/host/bluedroid/bta/jv/bta_jv_api.c
index 7419501550..7fb74fdfa8 100644
--- a/components/bt/host/bluedroid/bta/jv/bta_jv_api.c
+++ b/components/bt/host/bluedroid/bta/jv/bta_jv_api.c
@@ -696,7 +696,7 @@ on
 *******************************************************************************/
 int BTA_JvL2capRead(UINT32 handle, UINT32 req_id, UINT8 *p_data, UINT16 len)
 {
-    tBTA_JV_L2CAP_READ evt_data;
+    tBTA_JV_L2CAP_READ evt_data = {0};
 
     APPL_TRACE_API( "%s", __func__);
 
diff --git a/components/bt/host/bluedroid/bta/sys/utl.c b/components/bt/host/bluedroid/bta/sys/utl.c
index 94348e85f0..0c7954d45c 100644
--- a/components/bt/host/bluedroid/bta/sys/utl.c
+++ b/components/bt/host/bluedroid/bta/sys/utl.c
@@ -43,7 +43,7 @@ INT16 utl_str2int(const char *p_s)
 {
     INT32   val = 0;
 
-    for (; *p_s == ' ' && *p_s != 0; p_s++);
+    for (; *p_s == ' '; p_s++);
 
     if (*p_s == 0) {
         return -1;
diff --git a/components/bt/host/bluedroid/btc/profile/esp/ble_button/button_pro.c b/components/bt/host/bluedroid/btc/profile/esp/ble_button/button_pro.c
index 11126e0880..684c4e1da7 100644
--- a/components/bt/host/bluedroid/btc/profile/esp/ble_button/button_pro.c
+++ b/components/bt/host/bluedroid/btc/profile/esp/ble_button/button_pro.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -115,7 +115,7 @@ static void button_profile_cb(esp_gatts_evt_t event, esp_gatts_t *p_data)
         //uuid = {LEN_UUID_16, {ATT_CHAR_BUTTON_WIT}};
         //start the button service after created
         esp_ble_gatts_start_srvc(p_data->create.service_id);
-        //add the frist button characteristic --> write characteristic
+        //add the first button characteristic --> write characteristic
         esp_ble_gatts_add_char(button_cb_env.clcb.cur_srvc_id, &uuid,
                                (GATT_PERM_WRITE | GATT_PERM_READ),
                                (GATT_CHAR_PROP_BIT_READ | GATT_CHAR_PROP_BIT_WRITE));
@@ -128,15 +128,15 @@ static void button_profile_cb(esp_gatts_evt_t event, esp_gatts_t *p_data)
             tBTA_GATT_CHAR_PROP prop = (GATT_CHAR_PROP_BIT_READ | GATT_CHAR_PROP_BIT_NOTIFY);
             //save the att handle to the env
             button_cb_env.button_inst.but_wirt_hdl = p_data->add_result.attr_id;
-            //add the frist button characteristic --> Notify characteristic
+            //add the first button characteristic --> Notify characteristic
             esp_ble_gatts_add_char(button_cb_env.clcb.cur_srvc_id, &uuid,
                                    GATT_PERM_READ, (GATT_CHAR_PROP_BIT_READ | GATT_CHAR_PROP_BIT_NOTIFY));
-        } else if (p_data->add_result.char_uuid.uu.uuid16 == ATT_CHAR_BUTTON_NTF) { // add the gattc config descriptor to the notify charateristic
+        } else if (p_data->add_result.char_uuid.uu.uuid16 == ATT_CHAR_BUTTON_NTF) { // add the gattc config descriptor to the notify characteristic
             //tBTA_GATT_PERM perm = (GATT_PERM_WRITE|GATT_PERM_WRITE);
             uuid.uu.uuid16 = GATT_UUID_CHAR_CLIENT_CONFIG;
             button_cb_env.button_inst.but_ntf_hdl = p_data->add_result.attr_id;
             esp_ble_gatts_add_char_descr (button_cb_env.clcb.cur_srvc_id,
-                                          (GATT_PERM_WRITE | GATT_PERM_WRITE),
+                                          GATT_PERM_WRITE,
                                           &uuid);
         }
 
@@ -151,7 +151,7 @@ static void button_profile_cb(esp_gatts_evt_t event, esp_gatts_t *p_data)
         //BTA_GATTS_Listen(button_cb_env.gatt_if, true, NULL);
         break;
     case ESP_GATTS_CONNECT_EVT:
-        BTC_TRACE_ERROR("############BUTTON CONNCET EVT################\n");
+        BTC_TRACE_ERROR("############BUTTON CONNECT EVT################\n");
         //esp_ble_stop_advertising();
         //set the connection flag to true
         button_env_clcb_alloc(p_data->conn.conn_id, p_data->conn.remote_bda);
@@ -232,7 +232,7 @@ but_clcb_t *button_env_clcb_alloc (uint16_t conn_id, BD_ADDR remote_bda)
 **
 ** Function         button_env_find_conn_id_by_bd_adddr
 **
-** Description      The function searches all LCB with macthing bd address
+** Description      The function searches all LCB with matching bd address
 **
 ** Returns          total number of clcb found.
 **
@@ -280,7 +280,7 @@ BOOLEAN button_env_clcb_dealloc(uint16_t conn_id)
 **
 ** Function         button_init
 **
-** Description      Initializa the GATT Service for button profiles.
+** Description      Initialize the GATT Service for button profiles.
 **
 *******************************************************************************/
 esp_gatt_status_t button_init (but_prf_cb_t call_back)
@@ -323,7 +323,7 @@ void button_msg_notify(uint16_t len, uint8_t *button_msg)
     //notify rsp==false; indicate rsp==true.
     BOOLEAN rsp = false;
     if (!conn_status && button_cb_env.clcb.congest) {
-        BTC_TRACE_ERROR("the conneciton for button profile has been loss\n");
+        BTC_TRACE_ERROR("the connection for button profile has been loss\n");
         return;
     }
 
diff --git a/components/bt/host/bluedroid/btc/profile/esp/wechat_AirSync/wx_airsync_prf.c b/components/bt/host/bluedroid/btc/profile/esp/wechat_AirSync/wx_airsync_prf.c
index 9ba7ceed69..13b3998da3 100644
--- a/components/bt/host/bluedroid/btc/profile/esp/wechat_AirSync/wx_airsync_prf.c
+++ b/components/bt/host/bluedroid/btc/profile/esp/wechat_AirSync/wx_airsync_prf.c
@@ -1,6 +1,6 @@
 #include "wx_airsync_prf.h"
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -91,7 +91,7 @@ static void airsync_profile_cb(esp_gatts_evt_t event, esp_gatts_t *p_data)
         airsync_cb_env.is_primery =  p_data->create.is_primary;
         //start the airsync service after created
         esp_ble_gatts_start_srvc(p_data->create.service_id);
-        //add the frist airsync characteristic --> write characteristic
+        //add the first airsync characteristic --> write characteristic
         esp_ble_gatts_add_char(airsync_cb_env.clcb.cur_srvc_id, &uuid,
                                (GATT_PERM_WRITE | GATT_PERM_READ),
                                (GATT_CHAR_PROP_BIT_READ | GATT_CHAR_PROP_BIT_WRITE));
@@ -112,7 +112,7 @@ static void airsync_profile_cb(esp_gatts_evt_t event, esp_gatts_t *p_data)
             uuid.uu.uuid16 = GATT_UUID_CHAR_CLIENT_CONFIG;
             airsync_cb_env.airsync_inst.airsync_ntf_hdl = p_data->add_result.attr_id;
             esp_ble_gatts_add_char_descr (airsync_cb_env.clcb.cur_srvc_id,
-                                          (GATT_PERM_WRITE | GATT_PERM_WRITE),
+                                          GATT_PERM_WRITE,
                                           &uuid);
 
             uuid.uu.uuid16 = ATT_CHAR_AIRSYNC_READ;
@@ -207,7 +207,7 @@ tAirSync_CLCB *airsync_env_clcb_alloc (UINT16 conn_id, BD_ADDR remote_bda)
 **
 ** Function         airsync_env_find_conn_id_by_bd_adddr
 **
-** Description      The function searches all LCB with macthing bd address
+** Description      The function searches all LCB with matching bd address
 **
 ** Returns          total number of clcb found.
 **
@@ -231,7 +231,7 @@ UINT16 airsync_env_find_conn_id_by_bd_adddr(BD_ADDR remote_bda)
 **
 ** Function         airsync_init
 **
-** Description      Initializa the GATT Service for airsync profiles.
+** Description      Initialize the GATT Service for airsync profiles.
 **
 *******************************************************************************/
 tGATT_STATUS AirSync_Init(tAIRSYNC_CBACK *call_back)
diff --git a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c
index 4d5e7a497a..099bea519f 100644
--- a/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c
+++ b/components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c
@@ -290,14 +290,14 @@ static void bte_search_devices_evt(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_d
     /* Allocate buffer to hold the pointers (deep copy). The pointers will point to the end of the tBTA_DM_SEARCH */
     switch (event) {
     case BTA_DM_INQ_RES_EVT: {
-        if (p_data->inq_res.p_eir) {
+        if (p_data && p_data->inq_res.p_eir) {
             param_len += HCI_EXT_INQ_RESPONSE_LEN;
         }
     }
     break;
 
     case BTA_DM_DISC_RES_EVT: {
-        if (p_data->disc_res.raw_data_size && p_data->disc_res.p_raw_data) {
+        if (p_data && p_data->disc_res.raw_data_size && p_data->disc_res.p_raw_data) {
             param_len += p_data->disc_res.raw_data_size;
         }
     }
@@ -305,7 +305,7 @@ static void bte_search_devices_evt(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH *p_d
     }
 
     /* if remote name is available in EIR, set the flag so that stack doesn't trigger RNR */
-    if (event == BTA_DM_INQ_RES_EVT) {
+    if (p_data && (event == BTA_DM_INQ_RES_EVT)) {
         p_data->inq_res.remt_name_not_required = check_eir_remote_name(p_data, NULL, NULL);
     }
 
@@ -457,7 +457,7 @@ static void bte_dm_remote_service_record_evt(tBTA_DM_SEARCH_EVT event, tBTA_DM_S
     }
     /* Allocate buffer to hold the pointers (deep copy). The pointers will point to the end of the tBTA_DM_SEARCH */
     if (event == BTA_DM_DISC_RES_EVT) {
-        if (p_data->disc_res.raw_data_size && p_data->disc_res.p_raw_data) {
+        if (p_data && p_data->disc_res.raw_data_size && p_data->disc_res.p_raw_data) {
             param_len += p_data->disc_res.raw_data_size;
         }
     }
@@ -549,7 +549,7 @@ static void bte_dm_search_services_evt(tBTA_DM_SEARCH_EVT event, tBTA_DM_SEARCH
 
     switch (event) {
     case BTA_DM_DISC_RES_EVT: {
-        if ((p_data->disc_res.result == BTA_SUCCESS) && (p_data->disc_res.num_uuids > 0)) {
+        if (p_data && (p_data->disc_res.result == BTA_SUCCESS) && (p_data->disc_res.num_uuids > 0)) {
             param_len += (p_data->disc_res.num_uuids * MAX_UUID_SIZE);
         }
     } break;
diff --git a/components/bt/host/bluedroid/btc/profile/std/l2cap/btc_l2cap.c b/components/bt/host/bluedroid/btc/profile/std/l2cap/btc_l2cap.c
index 63477d6ce5..84641f31c8 100644
--- a/components/bt/host/bluedroid/btc/profile/std/l2cap/btc_l2cap.c
+++ b/components/bt/host/bluedroid/btc/profile/std/l2cap/btc_l2cap.c
@@ -719,7 +719,7 @@ static void btc_l2cap_write(uint32_t handle)
         }
         l2cap_slot_t *slot = NULL;
         slot = l2cap_find_slot_by_handle(handle);
-        if (!slot || (slot && !slot->connected)) {
+        if (!slot || !slot->connected) {
             if (!slot) {
                 BTC_TRACE_ERROR("%s unable to find l2cap slot!", __func__);
             } else {
@@ -749,7 +749,7 @@ static void btc_l2cap_disconnect(uint32_t handle)
         }
         l2cap_slot_t *slot = NULL;
         slot = l2cap_find_slot_by_handle(handle);
-        if (!slot || (slot && !slot->connected)) {
+        if (!slot || !slot->connected) {
             if (!slot) {
                 BTC_TRACE_ERROR("%s unable to find L2CAP slot! disconnect fail!", __func__);
             } else {
diff --git a/components/bt/host/bluedroid/btc/profile/std/pba/btc_pba_client.c b/components/bt/host/bluedroid/btc/profile/std/pba/btc_pba_client.c
index ede18df37a..6bc1819872 100644
--- a/components/bt/host/bluedroid/btc/profile/std/pba/btc_pba_client.c
+++ b/components/bt/host/bluedroid/btc/profile/std/pba/btc_pba_client.c
@@ -392,7 +392,7 @@ static bool btc_pba_client_pull_vcard_listing(uint16_t handle, char *name, bool
 
         if (include_app_param) {
             uint8_t search_value_len = 0;
-            if (app_param->include_search_value) {
+            if (app_param->include_search_value && app_param->search_value) {
                 search_value_len = strlen(app_param->search_value) + 1;
             }
             app_param_buff = osi_malloc(BTA_PBAP_PULL_VCARD_LISTING_APP_PARAM_BUFF_SIZE_MIN + search_value_len);
diff --git a/components/bt/host/bluedroid/btc/profile/std/spp/btc_spp.c b/components/bt/host/bluedroid/btc/profile/std/spp/btc_spp.c
index 8607e42191..31a71992dc 100644
--- a/components/bt/host/bluedroid/btc/profile/std/spp/btc_spp.c
+++ b/components/bt/host/bluedroid/btc/profile/std/spp/btc_spp.c
@@ -713,7 +713,7 @@ static void btc_spp_disconnect(btc_spp_args_t *arg)
         spp_slot_t *slot = NULL;
         osi_mutex_lock(&spp_local_param.spp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
         slot = spp_find_slot_by_handle(arg->disconnect.handle);
-        if (!slot || (slot && !slot->connected)) {
+        if (!slot || !slot->connected) {
             osi_mutex_unlock(&spp_local_param.spp_slot_mutex);
             if (!slot) {
                 BTC_TRACE_ERROR("%s unable to find RFCOMM slot! disconnect fail!", __func__);
@@ -894,7 +894,7 @@ static void btc_spp_write(btc_spp_args_t *arg)
         spp_slot_t *slot = NULL;
         osi_mutex_lock(&spp_local_param.spp_slot_mutex, OSI_MUTEX_MAX_TIMEOUT);
         slot = spp_find_slot_by_handle(arg->write.handle);
-        if (!slot || (slot && !slot->connected)) {
+        if (!slot || !slot->connected) {
             osi_mutex_unlock(&spp_local_param.spp_slot_mutex);
             if (!slot) {
                 BTC_TRACE_ERROR("%s unable to find RFCOMM slot!", __func__);
diff --git a/components/bt/host/bluedroid/hci/hci_hal_h4.c b/components/bt/host/bluedroid/hci/hci_hal_h4.c
index f91a2260d9..0baa265f2a 100644
--- a/components/bt/host/bluedroid/hci/hci_hal_h4.c
+++ b/components/bt/host/bluedroid/hci/hci_hal_h4.c
@@ -357,7 +357,7 @@ int hci_adv_credits_prep_to_release(uint16_t num)
     hci_hal_env.adv_credits_to_release = credits_to_release;
     osi_mutex_unlock(&hci_hal_env.adv_flow_lock);
 
-    if (credits_to_release == num && num != 0) {
+    if (credits_to_release == num) {
         osi_alarm_cancel(hci_hal_env.adv_flow_monitor);
         osi_alarm_set(hci_hal_env.adv_flow_monitor, HCI_ADV_FLOW_MONITOR_PERIOD_MS);
     }
diff --git a/components/bt/host/bluedroid/stack/avdt/avdt_scb.c b/components/bt/host/bluedroid/stack/avdt/avdt_scb.c
index 43bc4452c9..ca1e9f4c0f 100644
--- a/components/bt/host/bluedroid/stack/avdt/avdt_scb.c
+++ b/components/bt/host/bluedroid/stack/avdt/avdt_scb.c
@@ -749,14 +749,14 @@ UINT8 avdt_scb_verify(tAVDT_CCB *p_ccb, UINT8 state, UINT8 *p_seid, UINT16 num_s
         switch (state) {
         case AVDT_VERIFY_OPEN:
         case AVDT_VERIFY_START:
-            if (p_scb->state != AVDT_SCB_OPEN_ST && p_scb->state != AVDT_SCB_STREAM_ST) {
+            if (p_scb && p_scb->state != AVDT_SCB_OPEN_ST && p_scb->state != AVDT_SCB_STREAM_ST) {
                 *p_err_code = AVDT_ERR_BAD_STATE;
             }
             break;
 
         case AVDT_VERIFY_SUSPEND:
         case AVDT_VERIFY_STREAMING:
-            if (p_scb->state != AVDT_SCB_STREAM_ST) {
+            if (p_scb && p_scb->state != AVDT_SCB_STREAM_ST) {
                 *p_err_code = AVDT_ERR_BAD_STATE;
             }
             break;
diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble.c b/components/bt/host/bluedroid/stack/btm/btm_ble.c
index 46a5ba5190..a99614e93c 100644
--- a/components/bt/host/bluedroid/stack/btm/btm_ble.c
+++ b/components/bt/host/bluedroid/stack/btm/btm_ble.c
@@ -2389,7 +2389,7 @@ BOOLEAN BTM_BleVerifySignature (BD_ADDR bd_addr, UINT8 *p_orig, UINT16 len, UINT
     tBTM_SEC_DEV_REC *p_rec = btm_find_dev (bd_addr);
     UINT8 p_mac[BTM_CMAC_TLEN_SIZE];
 
-    if (p_rec == NULL || (p_rec && !(p_rec->ble.key_type & BTM_LE_KEY_PCSRK))) {
+    if (p_rec == NULL || !(p_rec->ble.key_type & BTM_LE_KEY_PCSRK)) {
         BTM_TRACE_ERROR("can not verify signature for unknown device");
     } else if (counter < p_rec->ble.keys.counter) {
         BTM_TRACE_ERROR("signature received with out dated sign counter");
diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_adv_filter.c b/components/bt/host/bluedroid/stack/btm/btm_ble_adv_filter.c
index 9da0914306..7eef55e912 100644
--- a/components/bt/host/bluedroid/stack/btm/btm_ble_adv_filter.c
+++ b/components/bt/host/bluedroid/stack/btm/btm_ble_adv_filter.c
@@ -429,8 +429,7 @@ BOOLEAN btm_ble_dealloc_addr_filter_counter(tBLE_BD_ADDR *p_bd_addr, UINT8 filte
 
     for (i = 0; i < cmn_ble_adv_vsc_cb.max_filter; i ++, p_addr_filter ++) {
         if ((p_addr_filter->in_use) && (NULL == p_bd_addr ||
-                                        (NULL != p_bd_addr &&
-                                         memcmp(p_bd_addr->bda, p_addr_filter->bd_addr, BD_ADDR_LEN) == 0))) {
+                                        (memcmp(p_bd_addr->bda, p_addr_filter->bd_addr, BD_ADDR_LEN) == 0)) {
             found = TRUE;
             memset(p_addr_filter, 0, sizeof(tBTM_BLE_PF_COUNT));
 
@@ -915,7 +914,7 @@ tBTM_STATUS btm_ble_clear_scan_pf_filter(tBTM_BLE_SCAN_COND_OP action,
 
     if (NULL == p_bda_filter ||
             /* not a generic filter */
-            (p_target != NULL && p_bda_filter)) {
+            (p_target != NULL)) {
         BTM_TRACE_ERROR("Error: Can not clear filter, No PF filter has been configured!");
         return st;
     }
diff --git a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
index 168f36af95..61580de047 100644
--- a/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
+++ b/components/bt/host/bluedroid/stack/btm/btm_ble_gap.c
@@ -3745,7 +3745,7 @@ static void btm_ble_process_adv_pkt_cont(BD_ADDR bda, UINT8 addr_type, UINT8 evt
     3. For same address and scan response, do nothing
     */
     int same_addr = memcmp(bda, p_le_inq_cb->adv_addr, BD_ADDR_LEN);
-    if (same_addr != 0 || (same_addr == 0 && evt_type != BTM_BLE_SCAN_RSP_EVT)) {
+    if (same_addr != 0 || (evt_type != BTM_BLE_SCAN_RSP_EVT)) {
         btm_ble_process_last_adv_pkt();
     }
 
@@ -3796,8 +3796,7 @@ static void btm_ble_process_adv_pkt_cont(BD_ADDR bda, UINT8 addr_type, UINT8 evt
         /* new device */
         if (p_i == NULL ||
                 /* assume a DUMO device, BR/EDR inquiry is always active */
-                (p_i &&
-                 (p_i->inq_info.results.device_type & BT_DEVICE_TYPE_BLE) == BT_DEVICE_TYPE_BLE &&
+                ((p_i->inq_info.results.device_type & BT_DEVICE_TYPE_BLE) == BT_DEVICE_TYPE_BLE &&
                  p_i->scan_rsp)) {
             BTM_TRACE_WARNING("INQ RES: Extra Response Received...cancelling inquiry..");
 
diff --git a/components/bt/host/bluedroid/stack/btm/btm_inq.c b/components/bt/host/bluedroid/stack/btm/btm_inq.c
index 41a47300e7..c74f2b4396 100644
--- a/components/bt/host/bluedroid/stack/btm/btm_inq.c
+++ b/components/bt/host/bluedroid/stack/btm/btm_inq.c
@@ -1860,7 +1860,7 @@ void btm_process_inq_results (UINT8 *p, UINT8 inq_res_mode)
                 /* new device response */
                 && ( p_i == NULL ||
                      /* existing device with BR/EDR info */
-                     (p_i && (p_i->inq_info.results.device_type & BT_DEVICE_TYPE_BREDR) != 0)
+                     ((p_i->inq_info.results.device_type & BT_DEVICE_TYPE_BREDR) != 0)
                    )
 #endif
 
diff --git a/components/bt/host/bluedroid/stack/btm/btm_pm.c b/components/bt/host/bluedroid/stack/btm/btm_pm.c
index 1c46a7446f..de48a2dad6 100644
--- a/components/bt/host/bluedroid/stack/btm/btm_pm.c
+++ b/components/bt/host/bluedroid/stack/btm/btm_pm.c
@@ -866,9 +866,7 @@ void btm_pm_proc_ssr_evt (UINT8 *p, UINT16 evt_len)
     /* notify registered parties */
     for (xx = 0; xx < BTM_MAX_PM_RECORDS; xx++) {
         if (btm_cb.pm_reg_db[xx].mask & BTM_PM_REG_NOTIF) {
-            if ( p_acl) {
-                (*btm_cb.pm_reg_db[xx].cback)( p_acl->remote_addr, BTM_PM_STS_SSR, use_ssr, status);
-            }
+            (*btm_cb.pm_reg_db[xx].cback)( p_acl->remote_addr, BTM_PM_STS_SSR, use_ssr, status);
         }
     }
 }
diff --git a/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c b/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c
index fc5f5b0700..6236f12a94 100644
--- a/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c
+++ b/components/bt/host/bluedroid/stack/l2cap/l2c_csm.c
@@ -916,7 +916,7 @@ static void l2c_csm_open (tL2C_CCB *p_ccb, UINT16 event, void *p_data)
 
     case L2CEVT_LP_QOS_VIOLATION_IND:               /* QOS violation         */
         /* Tell upper layer. If service guaranteed, then clear the channel   */
-        if (p_ccb->p_rcb->api.pL2CA_QoSViolationInd_Cb) {
+        if (p_ccb->p_rcb && p_ccb->p_rcb->api.pL2CA_QoSViolationInd_Cb) {
             (*p_ccb->p_rcb->api.pL2CA_QoSViolationInd_Cb)(p_ccb->p_lcb->remote_bd_addr);
         }
         break;
diff --git a/components/bt/host/bluedroid/stack/rfcomm/port_api.c b/components/bt/host/bluedroid/stack/rfcomm/port_api.c
index 1aa38ff77c..a6b5920cdb 100644
--- a/components/bt/host/bluedroid/stack/rfcomm/port_api.c
+++ b/components/bt/host/bluedroid/stack/rfcomm/port_api.c
@@ -181,7 +181,7 @@ int RFCOMM_CreateConnection (UINT16 uuid, UINT8 scn, BOOLEAN is_server,
     /* If the MTU is not specified (0), keep MTU decision until the
      * PN frame has to be send
      * at that time connection should be established and we
-     * will know for sure our prefered MTU
+     * will know for sure our preferred MTU
      */
 
     rfcomm_mtu = L2CAP_MTU_SIZE - RFCOMM_DATA_OVERHEAD;
@@ -298,12 +298,12 @@ int RFCOMM_RemoveServer (UINT16 handle)
 **
 ** Description      This function is called to provide an address of the
 **                  function which will be called when one of the events
-**                  specified in the mask occures.
+**                  specified in the mask occurs.
 **
 ** Parameters:      handle     - Handle returned in the RFCOMM_CreateConnection
 **                  p_callback - address of the callback function which should
 **                               be called from the RFCOMM when an event
-**                               specified in the mask occures.
+**                               specified in the mask occurs.
 **
 **
 *******************************************************************************/
@@ -537,8 +537,7 @@ BOOLEAN PORT_IsOpening (BD_ADDR bd_addr)
                 }
             }
 
-            if ((!found_port) ||
-                    (found_port && (p_port->rfc.state < RFC_STATE_OPENED))) {
+            if ((!found_port) || (p_port->rfc.state < RFC_STATE_OPENED)) {
                 /* Port is not established yet. */
                 memcpy (bd_addr, rfc_cb.port.rfc_mcb[xx].bd_addr, BD_ADDR_LEN);
                 return TRUE;
@@ -641,7 +640,7 @@ int PORT_GetRxQueueCnt (UINT16 handle, UINT16 *p_rx_queue_count)
 ** Function         PORT_GetState
 **
 ** Description      This function is called to fill tPORT_STATE structure
-**                  with the curremt control settings for the port
+**                  with the current control settings for the port
 **
 ** Parameters:      handle     - Handle returned in the RFCOMM_CreateConnection
 **                  p_settings - Pointer to a tPORT_STATE structure in which
@@ -1009,15 +1008,15 @@ int PORT_GetModemStatus (UINT16 handle, UINT8 *p_signal)
 **
 ** Function         PORT_ClearError
 **
-** Description      This function retreives information about a communications
+** Description      This function retrieves information about a communications
 **                  error and reports current status of a connection.  The
-**                  function should be called when an error occures to clear
+**                  function should be called when an error occurs to clear
 **                  the connection error flag and to enable additional read
 **                  and write operations.
 **
 ** Parameters:      handle     - Handle returned in the RFCOMM_CreateConnection
 **                  p_errors   - pointer of the variable to receive error codes
-**                  p_status   - pointer to the tPORT_STATUS structur to receive
+**                  p_status   - pointer to the tPORT_STATUS structure to receive
 **                               connection status
 **
 *******************************************************************************/
@@ -1090,7 +1089,7 @@ int PORT_SendError (UINT16 handle, UINT8 errors)
 ** Description      This function reports current status of a connection.
 **
 ** Parameters:      handle     - Handle returned in the RFCOMM_CreateConnection
-**                  p_status   - pointer to the tPORT_STATUS structur to receive
+**                  p_status   - pointer to the tPORT_STATUS structure to receive
 **                               connection status
 **
 *******************************************************************************/
@@ -1700,7 +1699,7 @@ int PORT_WriteData (UINT16 handle, char *p_data, UINT16 max_len, UINT16 *p_len)
 
         rc = port_write (p_port, p_buf);
 
-        /* If queue went below the threashold need to send flow control */
+        /* If queue went below the threshold need to send flow control */
         event |= port_flow_control_user (p_port);
 
         if (rc == PORT_SUCCESS) {
diff --git a/components/bt/host/bluedroid/stack/smp/smp_act.c b/components/bt/host/bluedroid/stack/smp/smp_act.c
index 3fc459ec6e..d05e1a7f7d 100644
--- a/components/bt/host/bluedroid/stack/smp/smp_act.c
+++ b/components/bt/host/bluedroid/stack/smp/smp_act.c
@@ -865,7 +865,7 @@ void smp_br_process_pairing_command(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
 
     SMP_TRACE_DEBUG("%s", __func__);
     /* rejecting BR pairing request over non-SC BR link */
-    if (!p_dev_rec->new_encryption_key_is_p256 && p_cb->role == HCI_ROLE_SLAVE) {
+    if (p_dev_rec && !p_dev_rec->new_encryption_key_is_p256 && p_cb->role == HCI_ROLE_SLAVE) {
         reason = SMP_XTRANS_DERIVE_NOT_ALLOW;
         smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &reason);
         return;
diff --git a/components/bt/host/bluedroid/stack/smp/smp_keys.c b/components/bt/host/bluedroid/stack/smp/smp_keys.c
index 855017a76a..3b1d4ee8f1 100644
--- a/components/bt/host/bluedroid/stack/smp/smp_keys.c
+++ b/components/bt/host/bluedroid/stack/smp/smp_keys.c
@@ -2231,7 +2231,7 @@ void smp_process_new_nonce(tSMP_CB *p_cb)
 static void smp_rand_back(tBTM_RAND_ENC *p)
 {
     tSMP_CB *p_cb = &smp_cb;
-    UINT8   *pp = p->param_buf;
+    UINT8   *pp = NULL;
     UINT8   failure = SMP_PAIR_FAIL_UNKNOWN;
     UINT8   state = p_cb->rand_enc_proc_state & ~0x80;
 
@@ -2249,11 +2249,13 @@ static void smp_rand_back(tBTM_RAND_ENC *p)
             break;
 
         case SMP_GEN_DIV_LTK:
+            pp = p->param_buf;
             STREAM_TO_UINT16(p_cb->div, pp);
             smp_generate_ltk_cont(p_cb, NULL);
             break;
 
         case SMP_GEN_DIV_CSRK:
+            pp = p->param_buf;
             STREAM_TO_UINT16(p_cb->div, pp);
             smp_compute_csrk(p_cb, NULL);
             break;