diff --git a/components/hal/esp32s2/include/hal/crypto_dma_ll.h b/components/hal/esp32s2/include/hal/crypto_dma_ll.h
index 793aeb7364a..a3590f53ba4 100644
--- a/components/hal/esp32s2/include/hal/crypto_dma_ll.h
+++ b/components/hal/esp32s2/include/hal/crypto_dma_ll.h
@@ -62,8 +62,8 @@ static inline void crypto_dma_ll_reset_register(void)
  */
 static inline void crypto_dma_ll_reset(void)
 {
-    SET_PERI_REG_MASK(CRYPTO_DMA_CONF0_REG, CONF0_REG_AHBM_RST | CONF0_REG_OUT_RST | CONF0_REG_AHBM_FIFO_RST);
-    CLEAR_PERI_REG_MASK(CRYPTO_DMA_CONF0_REG, CONF0_REG_AHBM_RST | CONF0_REG_OUT_RST | CONF0_REG_AHBM_FIFO_RST);
+    SET_PERI_REG_MASK(CRYPTO_DMA_CONF0_REG, CONF0_REG_AHBM_RST | CONF0_REG_IN_RST | CONF0_REG_OUT_RST | CONF0_REG_AHBM_FIFO_RST);
+    CLEAR_PERI_REG_MASK(CRYPTO_DMA_CONF0_REG, CONF0_REG_AHBM_RST | CONF0_REG_IN_RST | CONF0_REG_OUT_RST | CONF0_REG_AHBM_FIFO_RST);
 }
 
 /**
diff --git a/components/mbedtls/port/aes/dma/esp_aes_dma_core.c b/components/mbedtls/port/aes/dma/esp_aes_dma_core.c
index c8057a91e6e..ed25a434d1b 100644
--- a/components/mbedtls/port/aes/dma/esp_aes_dma_core.c
+++ b/components/mbedtls/port/aes/dma/esp_aes_dma_core.c
@@ -976,6 +976,26 @@ int esp_aes_process_dma(esp_aes_context *ctx, const unsigned char *input, unsign
         return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
     }
 
+#if SOC_AES_CRYPTO_DMA && CONFIG_SPIRAM
+    /* The Crypto DMA in-channel stalls indefinitely (no descriptor error is raised) when a
+       receive descriptor list transitions from a buffer in external RAM to one in internal
+       RAM. Avoid linking the internal stream buffer descriptor after external-RAM data
+       descriptors by processing the block-aligned part and the trailing partial block as
+       two separate DMA operations. */
+    if (block_bytes > 0 && stream_bytes > 0 && esp_ptr_external_ram(output)) {
+        ret = esp_aes_process_dma(ctx, input, output, block_bytes, NULL);
+        if (ret != 0) {
+            mbedtls_platform_zeroize(output, len);
+            return ret;
+        }
+        ret = esp_aes_process_dma(ctx, input + block_bytes, output + block_bytes, stream_bytes, stream_out);
+        if (ret != 0) {
+            mbedtls_platform_zeroize(output, len);
+        }
+        return ret;
+    }
+#endif /* SOC_AES_CRYPTO_DMA && CONFIG_SPIRAM */
+
     if (block_bytes > 0) {
         /* Flush cache if input in external ram */
 #if (CONFIG_SPIRAM && SOC_PSRAM_DMA_CAPABLE)
diff --git a/components/mbedtls/test_apps/main/test_aes.c b/components/mbedtls/test_apps/main/test_aes.c
index c73256e8d72..53d6b19221b 100644
--- a/components/mbedtls/test_apps/main/test_aes.c
+++ b/components/mbedtls/test_apps/main/test_aes.c
@@ -839,10 +839,10 @@ TEST_CASE("mbedtls OFB, chained DMA descriptors", "[aes]")
 
 
 const uint8_t expected_cipher_ctr_end[] = {
-    0x93, 0xca, 0xe0, 0x44, 0x96, 0x6d, 0xcb, 0xb2,
-    0xcf, 0x8a, 0x8d, 0x73, 0x8c, 0x6b, 0xfa, 0x4d,
-    0xd6, 0xc4, 0x18, 0x49, 0xdd, 0xc6, 0xbf, 0xc2,
-    0xb9, 0xf0, 0x09, 0x69, 0x45, 0x42, 0xc6, 0x05,
+    0x42, 0xf6, 0x3b, 0x8e, 0x11, 0x43, 0xc8, 0xc7,
+    0xd9, 0x85, 0xf3, 0xdc, 0x39, 0x6b, 0x33, 0x98,
+    0x8c, 0xc0, 0xf5, 0x92, 0xb4, 0x04, 0xf9, 0x2f,
+    0xdf, 0x12, 0xc0, 0xa1, 0xd2, 0xdc, 0x71, 0x88,
 };
 
 
@@ -852,7 +852,7 @@ void aes_ctr_alignment_test(uint32_t input_buf_caps, uint32_t output_buf_caps)
     uint8_t nonce[16];
     uint8_t key[16];
     uint8_t stream_block[16];
-    size_t SZ = 32*200;
+    size_t SZ = 32*200 + 33;
     size_t ALIGNMENT_SIZE_BYTES = 64;
     memset(nonce, 0x2F, 16);
     memset(key, 0x1E, 16);
@@ -911,7 +911,7 @@ void aes_psram_one_buf_ctr_test(void)
     uint8_t nonce[16];
     uint8_t key[16];
     uint8_t stream_block[16];
-    size_t SZ = 32*200;
+    size_t SZ = 32*200 + 33;
     size_t ALIGNMENT_SIZE_BYTES = 32;
     memset(nonce, 0x2F, 16);
     memset(key, 0x1E, 16);