diff --git a/components/bt/host/bluedroid/stack/smp/smp_act.c b/components/bt/host/bluedroid/stack/smp/smp_act.c
index 5b3d76ddd39..b161cfe8a0c 100644
--- a/components/bt/host/bluedroid/stack/smp/smp_act.c
+++ b/components/bt/host/bluedroid/stack/smp/smp_act.c
@@ -522,8 +522,17 @@ void smp_proc_sec_grant(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
 *******************************************************************************/
 void smp_proc_pair_fail(tSMP_CB *p_cb, tSMP_INT_DATA *p_data)
 {
-    SMP_TRACE_DEBUG("%s", __func__);
-    p_cb->status = *(UINT8 *)p_data;
+    UINT8 reason = *(UINT8 *)p_data;
+
+    SMP_TRACE_DEBUG("%s reason=0x%02x", __func__, reason);
+    /* A peer may send a reserved or out-of-range reason code; normalize it so
+     * upper layers always receive a defined pairing failure status. */
+    if (reason == SMP_SUCCESS || reason > SMP_MAX_FAIL_RSN_PER_SPEC) {
+        SMP_TRACE_WARNING("%s invalid pairing fail reason 0x%02x", __func__, reason);
+        reason = SMP_PAIR_FAIL_UNKNOWN;
+    }
+    p_cb->status = reason;
+    p_cb->failure = reason;
 }
 
 /*******************************************************************************
diff --git a/components/bt/host/bluedroid/stack/smp/smp_api.c b/components/bt/host/bluedroid/stack/smp/smp_api.c
index 7a592b775d6..e91f4fe619b 100644
--- a/components/bt/host/bluedroid/stack/smp/smp_api.c
+++ b/components/bt/host/bluedroid/stack/smp/smp_api.c
@@ -443,6 +443,17 @@ void SMP_OobDataReply(BD_ADDR bd_addr, tSMP_STATUS res, UINT8 len, UINT8 *p_data
         return;
     }
 
+    /* Reject an OOB reply that does not match the device currently pairing. */
+    if (memcmp(bd_addr, p_cb->pairing_bda, BD_ADDR_LEN) != 0) {
+        SMP_TRACE_ERROR("%s() - Wrong BD Addr", __func__);
+        return;
+    }
+
+    if (btm_find_dev(bd_addr) == NULL) {
+        SMP_TRACE_ERROR("%s() - no dev CB", __func__);
+        return;
+    }
+
     if (res != SMP_SUCCESS || len == 0 || !p_data) {
         SMP_TRACE_ERROR("%s pairing failed, res=0x%x len=%u p_data=%p",
             __func__, res, len, p_data);