diff --git a/components/wpa_supplicant/src/common/sae.c b/components/wpa_supplicant/src/common/sae.c
index 1d11ecfd658..e1295a86ac1 100644
--- a/components/wpa_supplicant/src/common/sae.c
+++ b/components/wpa_supplicant/src/common/sae.c
@@ -1827,10 +1827,12 @@ static void sae_parse_token_container(struct sae_data *sae,
 		    pos, end - pos);
 	if (!sae_is_token_container_elem(pos, end))
 		return;
-	*token = pos + 3;
-	*token_len = pos[1] - 1;
+	if (token)
+		*token = pos + 3;
+	if (token_len)
+		*token_len = pos[1] - 1;
 	wpa_hexdump(MSG_DEBUG, "SAE: Anti-Clogging Token (in container)",
-		    *token, *token_len);
+		    pos + 3, pos[1] - 1);
 }
 
 
diff --git a/components/wpa_supplicant/src/pasn/pasn_initiator.c b/components/wpa_supplicant/src/pasn/pasn_initiator.c
index 17c3aa01939..b23b4c69d4e 100644
--- a/components/wpa_supplicant/src/pasn/pasn_initiator.c
+++ b/components/wpa_supplicant/src/pasn/pasn_initiator.c
@@ -54,7 +54,7 @@ void pasn_initiator_pmksa_cache_remove(struct rsn_pmksa_cache *pmksa,
 {
 	struct rsn_pmksa_cache_entry *entry;
 
-	entry = pmksa_cache_get(pmksa, bssid, NULL, NULL, NULL);
+	entry = pmksa_cache_get(pmksa, bssid, NULL, NULL, NULL, 0);
 	if (!entry)
 		return;
 
@@ -68,7 +68,7 @@ int pasn_initiator_pmksa_cache_get(struct rsn_pmksa_cache *pmksa,
 {
 	struct rsn_pmksa_cache_entry *entry;
 
-	entry = pmksa_cache_get(pmksa, bssid, NULL, NULL, NULL);
+	entry = pmksa_cache_get(pmksa, bssid, NULL, NULL, NULL, 0);
 	if (entry) {
 		os_memcpy(pmkid, entry->pmkid, PMKID_LEN);
 		os_memcpy(pmk, entry->pmk, entry->pmk_len);
@@ -631,7 +631,7 @@ static struct wpabuf * wpas_pasn_build_auth_1(struct pasn_data *pasn,
 		struct rsn_pmksa_cache_entry *pmksa;
 
 		pmksa = pmksa_cache_get(pasn->pmksa, pasn->peer_addr, pasn->own_addr,
-					NULL, NULL);
+					NULL, NULL, pasn->akmp);
 		if (pmksa && pasn->custom_pmkid_valid)
 			pmkid = pasn->custom_pmkid;
 		else if (pmksa)
@@ -905,7 +905,7 @@ static int wpas_pasn_set_pmk(struct pasn_data *pasn,
 		}
 
 		pmksa = pmksa_cache_get(pasn->pmksa, pasn->peer_addr, pasn->own_addr,
-					pmkid, NULL);
+					pmkid, NULL, pasn->akmp);
 		if (pmksa) {
 			wpa_printf(MSG_DEBUG, "PASN: Using PMKSA");
 
diff --git a/components/wpa_supplicant/src/rsn_supp/pmksa_cache.c b/components/wpa_supplicant/src/rsn_supp/pmksa_cache.c
index 710de74ef17..e050857b972 100644
--- a/components/wpa_supplicant/src/rsn_supp/pmksa_cache.c
+++ b/components/wpa_supplicant/src/rsn_supp/pmksa_cache.c
@@ -344,7 +344,7 @@ void pmksa_cache_deinit(struct rsn_pmksa_cache *pmksa)
  */
 struct rsn_pmksa_cache_entry * pmksa_cache_get(struct rsn_pmksa_cache *pmksa,
         const u8 *aa, const u8 *spa, const u8 *pmkid,
-        const void *network_ctx)
+        const void *network_ctx, int akmp)
 {
     if(!pmksa)
         return NULL;
@@ -355,6 +355,7 @@ struct rsn_pmksa_cache_entry * pmksa_cache_get(struct rsn_pmksa_cache *pmksa,
                  os_memcmp(entry->spa, spa, ETH_ALEN) == 0) &&
                 (pmkid == NULL ||
                  os_memcmp(entry->pmkid, pmkid, PMKID_LEN) == 0) &&
+                (!akmp || akmp == entry->akmp) &&
                 (network_ctx == NULL || network_ctx == entry->network_ctx))
             return entry;
         entry = entry->next;
@@ -398,7 +399,7 @@ pmksa_cache_clone_entry(struct rsn_pmksa_cache *pmksa,
  */
 struct rsn_pmksa_cache_entry *
 pmksa_cache_get_opportunistic(struct rsn_pmksa_cache *pmksa, void *network_ctx,
-        const u8 *aa)
+        const u8 *aa, int akmp)
 {
     if (!pmksa)
         return NULL;
@@ -408,7 +409,8 @@ pmksa_cache_get_opportunistic(struct rsn_pmksa_cache *pmksa, void *network_ctx,
     if (network_ctx == NULL)
         return NULL;
     while (entry) {
-        if (entry->network_ctx == network_ctx) {
+        if (entry->network_ctx == network_ctx &&
+                (!akmp || akmp == entry->akmp)) {
             entry = pmksa_cache_clone_entry(pmksa, entry, aa);
             if (entry) {
                 wpa_printf(MSG_DEBUG, "RSN: added "
@@ -474,14 +476,14 @@ int pmksa_cache_set_current(struct wpa_sm *sm, const u8 *pmkid,
     sm->cur_pmksa = NULL;
     if (pmkid)
         sm->cur_pmksa = pmksa_cache_get(pmksa, NULL, sm->own_addr, pmkid,
-                network_ctx);
+                network_ctx, sm->key_mgmt);
     if (sm->cur_pmksa == NULL && bssid)
         sm->cur_pmksa = pmksa_cache_get(pmksa, bssid, sm->own_addr, NULL,
-                network_ctx);
+                network_ctx, sm->key_mgmt);
     if (sm->cur_pmksa == NULL && try_opportunistic && bssid)
         sm->cur_pmksa = pmksa_cache_get_opportunistic(pmksa,
                 network_ctx,
-                bssid);
+                bssid, sm->key_mgmt);
     if (sm->cur_pmksa) {
         wpa_hexdump(MSG_DEBUG, "RSN: PMKSA cache entry found - PMKID",
                 sm->cur_pmksa->pmkid, PMKID_LEN);
diff --git a/components/wpa_supplicant/src/rsn_supp/pmksa_cache.h b/components/wpa_supplicant/src/rsn_supp/pmksa_cache.h
index b5cc5aabe6f..5beea76d809 100644
--- a/components/wpa_supplicant/src/rsn_supp/pmksa_cache.h
+++ b/components/wpa_supplicant/src/rsn_supp/pmksa_cache.h
@@ -55,7 +55,7 @@ pmksa_cache_init(void (*free_cb)(struct rsn_pmksa_cache_entry *entry,
 void pmksa_cache_deinit(struct rsn_pmksa_cache *pmksa);
 struct rsn_pmksa_cache_entry * pmksa_cache_get(struct rsn_pmksa_cache *pmksa,
         const u8 *aa, const u8 *spa, const u8 *pmkid,
-        const void *network_ctx);
+        const void *network_ctx, int akmp);
 int pmksa_cache_list(struct rsn_pmksa_cache *pmksa, char *buf, size_t len);
 struct rsn_pmksa_cache_entry *
 pmksa_cache_add(struct rsn_pmksa_cache *pmksa, const u8 *pmk, size_t pmk_len,
@@ -71,7 +71,7 @@ int pmksa_cache_set_current(struct wpa_sm *sm, const u8 *pmkid,
         int try_opportunistic);
 struct rsn_pmksa_cache_entry *
 pmksa_cache_get_opportunistic(struct rsn_pmksa_cache *pmksa,
-        void *network_ctx, const u8 *aa);
+        void *network_ctx, const u8 *aa, int akmp);
 void pmksa_cache_flush(struct rsn_pmksa_cache *pmksa, void *network_ctx,
         const u8 *pmk, size_t pmk_len);
 void pmksa_cache_remove(struct rsn_pmksa_cache *pmksa,
@@ -93,7 +93,7 @@ static inline void pmksa_cache_deinit(struct rsn_pmksa_cache *pmksa)
 
     static inline struct rsn_pmksa_cache_entry *
 pmksa_cache_get(struct rsn_pmksa_cache *pmksa, const u8 *aa, const u8 *spa,
-        const u8 *pmkid, const void *network_ctx)
+        const u8 *pmkid, const void *network_ctx, int akmp)
 {
     return NULL;
 }
diff --git a/components/wpa_supplicant/src/rsn_supp/wpa.c b/components/wpa_supplicant/src/rsn_supp/wpa.c
index de26028db6b..bda26a5747d 100644
--- a/components/wpa_supplicant/src/rsn_supp/wpa.c
+++ b/components/wpa_supplicant/src/rsn_supp/wpa.c
@@ -405,7 +405,7 @@ static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
          * event before receiving this 1/4 message, so try to find a
          * matching PMKSA cache entry here. */
         sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, sm->own_addr,
-                pmkid, NULL);
+                pmkid, sm->network_ctx, sm->key_mgmt);
         if (sm->cur_pmksa) {
             wpa_printf(MSG_DEBUG,
                     "RSN: found matching PMKID from PMKSA cache");
@@ -474,7 +474,8 @@ static int wpa_supplicant_get_pmk(struct wpa_sm *sm,
                                      sm->network_ctx, sm->key_mgmt);
             }
             if (!sm->cur_pmksa && pmkid &&
-                pmksa_cache_get(sm->pmksa, src_addr, sm->own_addr, pmkid, NULL))
+                pmksa_cache_get(sm->pmksa, src_addr, sm->own_addr, pmkid,
+                                sm->network_ctx, sm->key_mgmt))
             {
                 wpa_printf( MSG_DEBUG,
                     "RSN: the new PMK matches with the "
@@ -2687,7 +2688,7 @@ int wpa_set_bss(uint8_t *macddr, uint8_t *bssid, uint8_t pairwise_cipher, uint8_
     struct rsn_pmksa_cache_entry *pmksa = NULL;
     if (use_pmk_cache) {
         pmksa = pmksa_cache_get(sm->pmksa, (const u8 *)bssid, sm->own_addr,
-                NULL, NULL);
+                NULL, NULL, 0);
         if (pmksa && (pmksa->akmp != sm->key_mgmt)) {
             use_pmk_cache = false;
         }
diff --git a/components/wpa_supplicant/src/tls/tlsv1_client.c b/components/wpa_supplicant/src/tls/tlsv1_client.c
index 431044c57be..0444310215e 100644
--- a/components/wpa_supplicant/src/tls/tlsv1_client.c
+++ b/components/wpa_supplicant/src/tls/tlsv1_client.c
@@ -614,7 +614,7 @@ int tlsv1_client_prf(struct tlsv1_client *conn, const char *label,
 int tlsv1_client_get_cipher(struct tlsv1_client *conn, char *buf,
 			    size_t buflen)
 {
-	char *cipher;
+	const char *cipher;
 
 	switch (conn->rl.cipher_suite) {
 	case TLS_RSA_WITH_RC4_128_MD5:
diff --git a/components/wpa_supplicant/src/tls/x509v3.c b/components/wpa_supplicant/src/tls/x509v3.c
index 1bbd80ade8d..5695006104a 100644
--- a/components/wpa_supplicant/src/tls/x509v3.c
+++ b/components/wpa_supplicant/src/tls/x509v3.c
@@ -459,7 +459,7 @@ int x509_parse_name(const u8 *buf, size_t len, struct x509_name *name,
 }
 
 
-static char * x509_name_attr_str(enum x509_name_attr_type type)
+static const char * x509_name_attr_str(enum x509_name_attr_type type)
 {
 	switch (type) {
 	case X509_NAME_ATTR_NOT_USED: