diff --git a/components/esp_coex/esp32/esp_coex_adapter.c b/components/esp_coex/esp32/esp_coex_adapter.c
index fbd93f6a6ad..65c1fa40021 100644
--- a/components/esp_coex/esp32/esp_coex_adapter.c
+++ b/components/esp_coex/esp32/esp_coex_adapter.c
@@ -46,7 +46,7 @@ void * esp_coex_common_spin_lock_create_wrapper(void)
     void *mux = heap_caps_malloc(sizeof(portMUX_TYPE), MALLOC_CAP_8BIT|MALLOC_CAP_INTERNAL);
 
     if (mux) {
-        memcpy(mux,&tmp,sizeof(portMUX_TYPE));
+        memcpy(mux, &tmp, sizeof(portMUX_TYPE));
         return mux;
     }
     return NULL;
diff --git a/components/esp_coex/esp32c5/esp_coex_adapter.c b/components/esp_coex/esp32c5/esp_coex_adapter.c
index 8588b7348d1..48b871c8a44 100644
--- a/components/esp_coex/esp32c5/esp_coex_adapter.c
+++ b/components/esp_coex/esp32c5/esp_coex_adapter.c
@@ -39,7 +39,7 @@ bool IRAM_ATTR esp_coex_common_env_is_chip_wrapper(void)
 void *esp_coex_common_spin_lock_create_wrapper(void)
 {
     portMUX_TYPE tmp = portMUX_INITIALIZER_UNLOCKED;
-    void *mux = malloc(sizeof(portMUX_TYPE));
+    void *mux = heap_caps_malloc(sizeof(portMUX_TYPE), MALLOC_CAP_8BIT|MALLOC_CAP_INTERNAL);
 
     if (mux) {
         memcpy(mux, &tmp, sizeof(portMUX_TYPE));
diff --git a/components/esp_coex/esp32c61/esp_coex_adapter.c b/components/esp_coex/esp32c61/esp_coex_adapter.c
index 059160f7bab..2778940239d 100644
--- a/components/esp_coex/esp32c61/esp_coex_adapter.c
+++ b/components/esp_coex/esp32c61/esp_coex_adapter.c
@@ -40,7 +40,7 @@ bool IRAM_ATTR esp_coex_common_env_is_chip_wrapper(void)
 void *esp_coex_common_spin_lock_create_wrapper(void)
 {
     portMUX_TYPE tmp = portMUX_INITIALIZER_UNLOCKED;
-    void *mux = malloc(sizeof(portMUX_TYPE));
+    void *mux = heap_caps_malloc(sizeof(portMUX_TYPE), MALLOC_CAP_8BIT|MALLOC_CAP_INTERNAL);
 
     if (mux) {
         memcpy(mux, &tmp, sizeof(portMUX_TYPE));
diff --git a/components/esp_rom/esp32c2/ld/esp32c2.rom.ld b/components/esp_rom/esp32c2/ld/esp32c2.rom.ld
index f230b784143..8406c6ddd52 100644
--- a/components/esp_rom/esp32c2/ld/esp32c2.rom.ld
+++ b/components/esp_rom/esp32c2/ld/esp32c2.rom.ld
@@ -525,7 +525,7 @@ pm_disable_sleep_delay_timer = 0x40001b74;
 /*pm_dream = 0x40001b78;*/
 pm_mac_wakeup = 0x40001b7c;
 pm_mac_sleep = 0x40001b80;
-pm_enable_active_timer = 0x40001b84;
+//pm_enable_active_timer = 0x40001b84;
 pm_enable_sleep_delay_timer = 0x40001b88;
 pm_local_tsf_process = 0x40001b8c;
 //pm_set_beacon_filter = 0x40001b90;
diff --git a/components/esp_rom/esp32c3/ld/esp32c3.rom.ld b/components/esp_rom/esp32c3/ld/esp32c3.rom.ld
index 192d3b69db6..cb57beeb40e 100644
--- a/components/esp_rom/esp32c3/ld/esp32c3.rom.ld
+++ b/components/esp_rom/esp32c3/ld/esp32c3.rom.ld
@@ -712,7 +712,7 @@ pm_disable_sleep_delay_timer = 0x40001650;
 /*pm_dream = 0x40001654;*/
 pm_mac_wakeup = 0x40001658;
 pm_mac_sleep = 0x4000165c;
-pm_enable_active_timer = 0x40001660;
+//pm_enable_active_timer = 0x40001660;
 pm_enable_sleep_delay_timer = 0x40001664;
 pm_local_tsf_process = 0x40001668;
 //pm_set_beacon_filter = 0x4000166c;
diff --git a/components/esp_rom/esp32c5/ld/esp32c5.rom.pp.ld b/components/esp_rom/esp32c5/ld/esp32c5.rom.pp.ld
index 0c7d024d67a..3f0eec242e7 100644
--- a/components/esp_rom/esp32c5/ld/esp32c5.rom.pp.ld
+++ b/components/esp_rom/esp32c5/ld/esp32c5.rom.pp.ld
@@ -110,7 +110,7 @@ pm_disable_sleep_delay_timer = 0x40000d50;
 pm_dream = 0x40000d54;
 pm_mac_wakeup = 0x40000d58;
 pm_mac_sleep = 0x40000d5c;
-pm_enable_active_timer = 0x40000d60;
+//pm_enable_active_timer = 0x40000d60;
 pm_enable_sleep_delay_timer = 0x40000d64;
 pm_local_tsf_process = 0x40000d68;
 //pm_set_beacon_filter = 0x40000d6c;
diff --git a/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld b/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld
index 4f5a17278ce..a700a1d35c5 100644
--- a/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld
+++ b/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld
@@ -26,7 +26,7 @@ pm_check_state = 0x40000cb4;
 pm_set_beacon_filter = 0x40000cd8;
 //pm_is_in_wifi_slice_threshold = 0x40000cdc;
 //pm_keep_alive = 0x40000ce4;
-pm_process_tim = 0x40000d14;
+//pm_process_tim = 0x40000d14;
 //pm_tbtt_process = 0x40000d28;
 pm_tx_data_process = 0x40000d44;
 pm_twt_process = 0x40000d54;
diff --git a/components/esp_rom/esp32c61/ld/esp32c61.rom.pp.ld b/components/esp_rom/esp32c61/ld/esp32c61.rom.pp.ld
index 315b0c1e54d..3f50cd1670d 100644
--- a/components/esp_rom/esp32c61/ld/esp32c61.rom.pp.ld
+++ b/components/esp_rom/esp32c61/ld/esp32c61.rom.pp.ld
@@ -107,7 +107,7 @@ pm_disable_sleep_delay_timer = 0x40000cbc;
 pm_dream = 0x40000cc0;
 pm_mac_wakeup = 0x40000cc4;
 pm_mac_sleep = 0x40000cc8;
-pm_enable_active_timer = 0x40000ccc;
+//pm_enable_active_timer = 0x40000ccc;
 pm_enable_sleep_delay_timer = 0x40000cd0;
 pm_local_tsf_process = 0x40000cd4;
 /*pm_set_beacon_filter = 0x40000cd8;*/
diff --git a/components/esp_rom/esp32s3/ld/esp32s3.rom.ld b/components/esp_rom/esp32s3/ld/esp32s3.rom.ld
index 897d671054d..ce02c641fd0 100644
--- a/components/esp_rom/esp32s3/ld/esp32s3.rom.ld
+++ b/components/esp_rom/esp32s3/ld/esp32s3.rom.ld
@@ -966,7 +966,7 @@ pm_disable_sleep_delay_timer = 0x40005430;
 /*pm_dream = 0x4000543c;*/
 pm_mac_wakeup = 0x40005448;
 pm_mac_sleep = 0x40005454;
-pm_enable_active_timer = 0x40005460;
+//pm_enable_active_timer = 0x40005460;
 pm_enable_sleep_delay_timer = 0x4000546c;
 pm_local_tsf_process = 0x40005478;
 //pm_set_beacon_filter = 0x40005484;
diff --git a/components/esp_rom/esp32s31/esp_rom_heap_tlsf_stub_table.h b/components/esp_rom/esp32s31/esp_rom_heap_tlsf_stub_table.h
deleted file mode 100644
index 3f72f32284e..00000000000
--- a/components/esp_rom/esp32s31/esp_rom_heap_tlsf_stub_table.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-
-#pragma once
-
-#include <stddef.h>
-#include "esp_rom_tlsf.h"
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/**
- * @brief TLSF ROM vtable stub table for esp32s31.
- *
- * This struct mirrors the TLSF function-pointer vtable stored in ROM.
- * Its layout MUST exactly match the ROM vtable for the target chip.
- * It is used by tlsf_set_rom_patches() to intercept TLSF calls.
- */
-struct heap_tlsf_stub_table_t {
-    tlsf_t (*tlsf_create)(void *mem, size_t max_bytes);
-    tlsf_t (*tlsf_create_with_pool)(void *mem, size_t pool_bytes, size_t max_bytes);
-    pool_t (*tlsf_get_pool)(tlsf_t tlsf);
-    pool_t (*tlsf_add_pool)(tlsf_t tlsf, void *mem, size_t bytes);
-    void (*tlsf_remove_pool)(tlsf_t tlsf, pool_t pool);
-
-    void *(*tlsf_malloc)(tlsf_t tlsf, size_t size);
-    void *(*tlsf_memalign)(tlsf_t tlsf, size_t align, size_t size);
-    void *(*tlsf_memalign_offs)(tlsf_t tlsf, size_t align, size_t size, size_t offset);
-    void *(*tlsf_realloc)(tlsf_t tlsf, void *ptr, size_t size);
-    void (*tlsf_free)(tlsf_t tlsf, void *ptr);
-
-    size_t (*tlsf_block_size)(void *ptr);
-    size_t (*tlsf_size)(tlsf_t tlsf);
-    size_t (*tlsf_align_size)(void);
-    size_t (*tlsf_block_size_min)(void);
-    /* NOTE: The ROM signature is tlsf_block_size_max(control_t *control), but
-     * control_t is an internal TLSF type not exposed in any public header.
-     * Since tlsf_t is typedef'd as void* (same as control_t), the ABI is
-     * identical and we use tlsf_t here to keep this header self-contained. */
-    size_t (*tlsf_block_size_max)(tlsf_t tlsf);
-    size_t (*tlsf_pool_overhead)(void);
-    size_t (*tlsf_alloc_overhead)(void);
-
-    void (*tlsf_walk_pool)(pool_t pool, tlsf_walker walker, void *user);
-
-    int (*tlsf_check)(tlsf_t tlsf);
-    int (*tlsf_check_pool)(pool_t pool);
-
-    void *(*tlsf_malloc_addr)(tlsf_t tlsf, size_t size, void *address);
-};
-
-#ifdef __cplusplus
-}
-#endif
diff --git a/components/esp_wifi/lib b/components/esp_wifi/lib
index bb69e7e609c..34e7c075b93 160000
--- a/components/esp_wifi/lib
+++ b/components/esp_wifi/lib
@@ -1 +1 @@
-Subproject commit bb69e7e609c9a9a909ddd1ed175f36df2bd13801
+Subproject commit 34e7c075b9346dc22a281df22e315817f0062da8
diff --git a/examples/wifi/itwt/main/wifi_itwt_cmd.c b/examples/wifi/itwt/main/wifi_itwt_cmd.c
index 157a88ef067..3975d79c40c 100644
--- a/examples/wifi/itwt/main/wifi_itwt_cmd.c
+++ b/examples/wifi/itwt/main/wifi_itwt_cmd.c
@@ -144,7 +144,7 @@ static int wifi_cmd_itwt(int argc, char **argv)
         bool all_twt = itwt_args.all_twt->count ? (itwt_args.all_twt->ival[0] ? true : false) : false;
         flow_id = (all_twt == true) ? FLOW_ID_ALL : flow_id;
         int suspend_time_ms = itwt_args.suspend_time_ms->count ? itwt_args.suspend_time_ms->ival[0] : 0;
-        if (flow_id > 0) {
+        if (flow_id >= 0) {
             err = esp_wifi_sta_itwt_suspend(flow_id, suspend_time_ms);
             ESP_LOGI(TAG, "(itwt)suspend, flow_id:%d, all_twt:%d, suspend:%d ms, err:0x%x", flow_id, all_twt, suspend_time_ms, err);
         } else {