diff --git a/components/bt/host/bluedroid/api/esp_hf_ag_api.c b/components/bt/host/bluedroid/api/esp_hf_ag_api.c
index 25e5b7bdcc9..e9286fadc8c 100644
--- a/components/bt/host/bluedroid/api/esp_hf_ag_api.c
+++ b/components/bt/host/bluedroid/api/esp_hf_ag_api.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -77,6 +77,9 @@ esp_err_t esp_hf_ag_slc_connect(esp_bd_addr_t remote_addr)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -96,6 +99,9 @@ esp_err_t esp_hf_ag_slc_disconnect(esp_bd_addr_t remote_addr)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -115,6 +121,9 @@ esp_err_t esp_hf_ag_audio_connect(esp_bd_addr_t remote_addr)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -134,6 +143,9 @@ esp_err_t esp_hf_ag_audio_disconnect(esp_bd_addr_t remote_addr)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -153,6 +165,9 @@ esp_err_t esp_hf_ag_vra_control(esp_bd_addr_t remote_addr, esp_hf_vr_state_t val
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -161,7 +176,7 @@ esp_err_t esp_hf_ag_vra_control(esp_bd_addr_t remote_addr, esp_hf_vr_state_t val
     btc_hf_args_t arg;
     memset(&arg, 0, sizeof(btc_hf_args_t));
     arg.vra_rep.value = value;
-    memcpy(&(arg.volcon.remote_addr), remote_addr, sizeof(esp_bd_addr_t));
+    memcpy(&(arg.vra_rep.remote_addr), remote_addr, sizeof(esp_bd_addr_t));
 
     /* Switch to BTC context */
     bt_status_t status = btc_transfer_context(&msg, &arg, sizeof(btc_hf_args_t), NULL, NULL);
@@ -173,6 +188,9 @@ esp_err_t esp_hf_ag_volume_control(esp_bd_addr_t remote_addr, esp_hf_volume_cont
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     if (volume < 0 || volume > 15) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -197,6 +215,9 @@ esp_err_t esp_hf_ag_unknown_at_send(esp_bd_addr_t remote_addr, char *unat)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL || unat == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -218,6 +239,9 @@ esp_err_t esp_hf_ag_cmee_send(esp_bd_addr_t remote_addr, esp_hf_at_response_code
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -268,6 +292,9 @@ esp_err_t esp_hf_ag_ciev_report(esp_bd_addr_t remote_addr, esp_hf_ciev_report_ty
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -293,6 +320,9 @@ esp_err_t esp_hf_ag_cind_response(esp_bd_addr_t remote_addr,
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     if (signal < 0 || signal > 5 || batt_lev < 0 || batt_lev > 5) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -323,6 +353,9 @@ esp_err_t esp_hf_ag_cops_response(esp_bd_addr_t remote_addr, char *name)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL || name == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -346,6 +379,9 @@ esp_err_t esp_hf_ag_clcc_response(esp_bd_addr_t remote_addr, int index, esp_hf_c
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -375,6 +411,9 @@ esp_err_t esp_hf_ag_cnum_response(esp_bd_addr_t remote_addr, char *number, int n
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     if (number == NULL || number_type < 128 || number_type > 175) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -385,7 +424,7 @@ esp_err_t esp_hf_ag_cnum_response(esp_bd_addr_t remote_addr, char *number, int n
 
     btc_hf_args_t arg;
     memset(&arg, 0, sizeof(btc_hf_args_t));
-    memcpy(&(arg.cnum_rep), remote_addr, sizeof(esp_bd_addr_t));
+    memcpy(&(arg.cnum_rep.remote_addr), remote_addr, sizeof(esp_bd_addr_t));
     arg.cnum_rep.number = number; //deep_copy
     arg.cnum_rep.number_type = number_type;
     arg.cnum_rep.service_type = service_type;
@@ -401,6 +440,9 @@ esp_err_t esp_hf_ag_bsir(esp_bd_addr_t remote_addr, esp_hf_in_band_ring_state_t
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -423,6 +465,9 @@ esp_err_t esp_hf_ag_answer_call(esp_bd_addr_t remote_addr, int num_active, int n
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -451,6 +496,9 @@ esp_err_t esp_hf_ag_reject_call(esp_bd_addr_t remote_addr, int num_active, int n
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -479,6 +527,9 @@ esp_err_t esp_hf_ag_end_call(esp_bd_addr_t remote_addr, int num_active, int num_
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
@@ -507,6 +558,9 @@ esp_err_t esp_hf_ag_out_call(esp_bd_addr_t remote_addr, int num_active, int num_
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_addr == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
     btc_msg_t msg;
     msg.sig = BTC_SIG_API_CALL;
     msg.pid = BTC_PID_HF;
diff --git a/components/bt/host/bluedroid/api/esp_hf_client_api.c b/components/bt/host/bluedroid/api/esp_hf_client_api.c
index f454acc09a3..2968095b2ac 100644
--- a/components/bt/host/bluedroid/api/esp_hf_client_api.c
+++ b/components/bt/host/bluedroid/api/esp_hf_client_api.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -68,6 +68,9 @@ esp_err_t esp_hf_client_connect(esp_bd_addr_t remote_bda)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_bda == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
 
     bt_status_t stat;
     btc_hf_client_args_t arg;
@@ -90,6 +93,9 @@ esp_err_t esp_hf_client_disconnect(esp_bd_addr_t remote_bda)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_bda == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
 
     bt_status_t stat;
     btc_hf_client_args_t arg;
@@ -112,6 +118,9 @@ esp_err_t esp_hf_client_connect_audio(esp_bd_addr_t remote_bda)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_bda == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
 
     bt_status_t stat;
     btc_hf_client_args_t arg;
@@ -134,6 +143,9 @@ esp_err_t esp_hf_client_disconnect_audio(esp_bd_addr_t remote_bda)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (remote_bda == NULL) {
+        return ESP_ERR_INVALID_ARG;
+    }
 
     bt_status_t stat;
     btc_hf_client_args_t arg;
@@ -191,6 +203,9 @@ esp_err_t esp_hf_client_volume_update(esp_hf_volume_control_target_t type, int v
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (volume < 0 || volume > 15) {
+        return ESP_ERR_INVALID_ARG;
+    }
 
     btc_msg_t msg;
     btc_hf_client_args_t arg;
@@ -391,6 +406,10 @@ esp_err_t esp_hf_client_send_dtmf(char code)
     if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
         return ESP_ERR_INVALID_STATE;
     }
+    if (!((code >= '0' && code <= '9') || code == '*' || code == '#' ||
+          (code >= 'A' && code <= 'D'))) {
+        return ESP_ERR_INVALID_ARG;
+    }
 
     btc_msg_t msg;
     btc_hf_client_args_t arg;
@@ -553,6 +572,9 @@ esp_err_t esp_hf_client_pkt_stat_nums_get(uint16_t sync_conn_handle)
 
 void esp_hf_client_outgoing_data_ready(void)
 {
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return;
+    }
     BTA_HfClientCiData();
 }
 
diff --git a/components/bt/host/bluedroid/api/include/api/esp_hf_client_api.h b/components/bt/host/bluedroid/api/include/api/esp_hf_client_api.h
index a61372793dd..3d50fcc4406 100644
--- a/components/bt/host/bluedroid/api/include/api/esp_hf_client_api.h
+++ b/components/bt/host/bluedroid/api/include/api/esp_hf_client_api.h
@@ -683,7 +683,7 @@ esp_err_t esp_hf_client_send_nrec(void);
  * @return
  *                  - ESP_OK: success
  *                  - ESP_ERR_INVALID_STATE: if bluetooth stack is not yet enabled
- *                  - ESP_FAIL: if callback is a NULL function pointer
+ *                  - ESP_FAIL: others
  *
  */
 esp_err_t esp_hf_client_register_data_callback(esp_hf_client_incoming_data_cb_t recv,
diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c b/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c
index 6000f8324c2..488ad0937f9 100644
--- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c
+++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c
@@ -134,7 +134,7 @@ void bta_ag_ci_rx_write(UINT16 handle, char *p_data, UINT16 len)
             p_buf->hdr.event = BTA_AG_CI_RX_WRITE_EVT;
             p_buf->hdr.layer_specific = handle;
             p_data_area = (char *)(p_buf+1);        /* Point to data area after header */
-            strncpy(p_data_area, p_data, len);
+            memcpy(p_data_area, p_data, len);
             p_data_area[len] = 0;
             bta_sys_sendmsg(p_buf);
         } else {
@@ -284,6 +284,7 @@ static void bta_ag_decode_msbc_frame(UINT8 **data, UINT8 *length, BOOLEAN is_bad
         {
             bta_hf_ct_plc.first_good_frame_found = TRUE;
             sbc_plc_good_frame(&(bta_hf_ct_plc.plc_state), (int16_t *)bta_ag_co_cb.decode_raw_data, bta_hf_ct_plc.sbc_plc_out);
+            break;
         }
 
         case OI_CODEC_SBC_NOT_ENOUGH_HEADER_DATA:
diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
index 66162261fd0..200549c2ab8 100644
--- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
+++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -595,7 +595,7 @@ static bt_status_t btc_hf_cind_response(bt_bdaddr_t *bd_addr,
     if (is_connected(idx, bd_addr)) {
         tBTA_AG_RES_DATA    ag_res;
         memset(&ag_res, 0, sizeof (ag_res));
-        sprintf(ag_res.str, "%d,%d,%d,%d,%d,%d,%d",
+        snprintf(ag_res.str, sizeof(ag_res.str), "%d,%d,%d,%d,%d,%d,%d",
                 call_status,                                           /* Call state*/
                 call_setup_status,                                     /* Callsetup state */
                 ntk_state,                                             /* network service */
@@ -620,7 +620,7 @@ static bt_status_t btc_hf_cops_response(bt_bdaddr_t *bd_addr, const char *name)
         tBTA_AG_RES_DATA    ag_res;
         memset (&ag_res, 0, sizeof (ag_res));
         /* Format the response */
-        sprintf(ag_res.str, "0,0,\"%s\"", name);
+        snprintf(ag_res.str, sizeof(ag_res.str), "0,0,\"%s\"", name);
         ag_res.ok_flag = BTA_AG_OK_DONE;
         BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_COPS_RES, &ag_res);
         return BT_STATUS_SUCCESS;
@@ -645,12 +645,12 @@ static bt_status_t btc_hf_clcc_response(bt_bdaddr_t *bd_addr, int index, esp_hf_
         } else {
             BTC_TRACE_EVENT("clcc_response: [%d] dir: %d current_call_state: %d mode: %d number: %s type: %d",
                             index, dir, current_call_state, mode, number, type);
-            int loc = sprintf (ag_res.str, "%d,%d,%d,%d,%d", index, dir, current_call_state, mode, mpty);
-            if (number) {
+            int loc = snprintf(ag_res.str, sizeof(ag_res.str), "%d,%d,%d,%d,%d", index, dir, current_call_state, mode, mpty);
+            if (number && loc >= 0 && (size_t)loc < sizeof(ag_res.str)) {
                if ((type == ESP_HF_CALL_ADDR_TYPE_INTERNATIONAL) && (*number != '+')) {
-                    sprintf(&ag_res.str[loc], ",\"+%s\",%d", number, type);
+                    snprintf(ag_res.str + loc, sizeof(ag_res.str) - (size_t)loc, ",\"+%s\",%d", number, type);
                 } else {
-                    sprintf(&ag_res.str[loc], ",\"%s\",%d", number, type);
+                    snprintf(ag_res.str + loc, sizeof(ag_res.str) - (size_t)loc, ",\"%s\",%d", number, type);
                 }
             }
         }
@@ -671,9 +671,9 @@ static bt_status_t btc_hf_cnum_response(bt_bdaddr_t *bd_addr, const char *number
         memset(&ag_res, 0, sizeof (ag_res));
         BTC_TRACE_EVENT("cnum_response: number = %s, number type = %d, service type = %d", number, number_type, service_type);
         if (service_type) {
-            sprintf(ag_res.str, ",\"%s\",%d,,%d",number, number_type, service_type);
+            snprintf(ag_res.str, sizeof(ag_res.str), ",\"%s\",%d,,%d", number, number_type, service_type);
         } else {
-            sprintf(ag_res.str, ",\"%s\",%d,,",number, number_type);
+            snprintf(ag_res.str, sizeof(ag_res.str), ",\"%s\",%d,,", number, number_type);
         }
         ag_res.ok_flag = BTA_AG_OK_DONE;
         BTA_AgResult(hf_local_param.btc_hf_cb[idx].handle, BTA_AG_CNUM_RES, &ag_res);
@@ -832,13 +832,13 @@ static bt_status_t btc_hf_phone_state_update(bt_bdaddr_t *bd_addr,int num_active
                 if (number) {
                     int loc = 0;
                     if ((type == ESP_HF_CALL_ADDR_TYPE_INTERNATIONAL) && (*number != '+')) {
-                        loc = sprintf (ag_res.str, "\"+%s\"", number);
+                        loc = snprintf(ag_res.str, sizeof(ag_res.str), "\"+%s\"", number);
                     } else {
-                        loc = sprintf (ag_res.str, "\"%s\"", number);
+                        loc = snprintf(ag_res.str, sizeof(ag_res.str), "\"%s\"", number);
                     }
                     ag_res.num = type;
-                    if (res == BTA_AG_CALL_WAIT_RES) {
-                        sprintf(&ag_res.str[loc], ",%d", type);
+                    if (res == BTA_AG_CALL_WAIT_RES && loc >= 0 && (size_t)loc < sizeof(ag_res.str)) {
+                        snprintf(ag_res.str + loc, sizeof(ag_res.str) - (size_t)loc, ",%d", type);
                     }
                 }
                 break;
@@ -1567,9 +1567,11 @@ void btc_hf_cb_handler(btc_msg_t *msg)
                     memcpy(param.out_call.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                     param.out_call.type = p_data->val.value;
                     param.out_call.num_or_loc = osi_malloc((strlen(p_data->val.str) + 1) * sizeof(char));
-                    sprintf(param.out_call.num_or_loc, "%s", p_data->val.str);
-                    btc_hf_cb_to_app(ESP_HF_DIAL_EVT, &param);
-                    osi_free(param.out_call.num_or_loc);
+                    if (param.out_call.num_or_loc) {
+                        snprintf(param.out_call.num_or_loc, strlen(p_data->val.str) + 1, "%s", p_data->val.str);
+                        btc_hf_cb_to_app(ESP_HF_DIAL_EVT, &param);
+                        osi_free(param.out_call.num_or_loc);
+                    }
                 } else if (event == BTA_AG_AT_BLDN_EVT) {                    //dial_last
                     memcpy(param.out_call.remote_addr, &hf_local_param.btc_hf_cb[idx].connected_bda,sizeof(esp_bd_addr_t));
                     param.out_call.num_or_loc = NULL;
diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c b/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c
index 555e7137db7..0980067048c 100644
--- a/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c
+++ b/components/bt/host/bluedroid/btc/profile/std/hf_client/bta_hf_client_co.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -196,7 +196,7 @@ void bta_hf_client_sco_co_open(UINT16 handle, UINT8 air_mode, UINT8 inout_pkt_si
 
 #if (PLC_INCLUDED == TRUE)
         bta_hf_ct_plc_ptr = (bta_hf_ct_plc_t *)osi_calloc(sizeof(bta_hf_ct_plc_t));
-            if (!bta_hf_ct_plc_ptr) {
+        if (!bta_hf_ct_plc_ptr) {
             APPL_TRACE_ERROR("%s malloc fail.", __FUNCTION__);
             goto error_exit;
         }
@@ -249,12 +249,16 @@ void bta_hf_client_sco_co_close(void)
 
     if (hf_air_mode == BTM_SCO_AIR_MODE_TRANSPNT) {
 #if (PLC_INCLUDED == TRUE)
+#if (HFP_DYNAMIC_MEMORY == TRUE)
+        if (bta_hf_ct_plc_ptr != NULL) {
+            sbc_plc_deinit(&(bta_hf_ct_plc.plc_state));
+            bta_hf_ct_plc.first_good_frame_found = FALSE;
+            osi_free(bta_hf_ct_plc_ptr);
+            bta_hf_ct_plc_ptr = NULL;
+        }
+#else
         sbc_plc_deinit(&(bta_hf_ct_plc.plc_state));
         bta_hf_ct_plc.first_good_frame_found = FALSE;
-
-#if (HFP_DYNAMIC_MEMORY == TRUE)
-        osi_free(bta_hf_ct_plc_ptr);
-        bta_hf_ct_plc_ptr = NULL;
 #endif  /// (HFP_DYNAMIC_MEMORY == TRUE)
 
 #endif  ///(PLC_INCLUDED == TRUE)
@@ -399,6 +403,7 @@ static void bta_hf_client_decode_msbc_frame(UINT8 **data, UINT8 *length, BOOLEAN
         case OI_OK:
             bta_hf_ct_plc.first_good_frame_found = TRUE;
             sbc_plc_good_frame(&(bta_hf_ct_plc.plc_state), (int16_t *)bta_hf_client_co_cb.decode_raw_data, bta_hf_ct_plc.sbc_plc_out);
+            break;
         case OI_CODEC_SBC_NOT_ENOUGH_HEADER_DATA:
         case OI_CODEC_SBC_NOT_ENOUGH_BODY_DATA:
         case OI_CODEC_SBC_NOT_ENOUGH_AUDIO_DATA:
@@ -432,11 +437,11 @@ static void bta_hf_client_decode_msbc_frame(UINT8 **data, UINT8 *length, BOOLEAN
             APPL_TRACE_ERROR("Frame decode error: %d", status);
             break;
     }
-#endif  ///(PLC_INCLUDED == TRUE)
 
-    if (OI_SUCCESS(status)){
+    if (OI_SUCCESS(status)) {
         btc_hf_client_incoming_data_cb_to_app((const uint8_t *)(bta_hf_ct_plc.sbc_plc_out), sbc_raw_data_size);
     }
+#endif  ///(PLC_INCLUDED == TRUE)
 }
 
 /*******************************************************************************
diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c b/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c
index e56c7a04b51..d0c7242890d 100644
--- a/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c
+++ b/components/bt/host/bluedroid/btc/profile/std/hf_client/btc_hf_client.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -14,7 +14,6 @@
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
-#include <stdlib.h>
 #include "common/bt_defs.h"
 #include "device/bdaddr.h"
 #include "btc/btc_dm.h"
@@ -517,6 +516,8 @@ static bt_status_t btc_hf_client_send_chld_cmd(esp_hf_chld_type_t type, int idx)
         }
         return BT_STATUS_UNSUPPORTED;
 
+    default:
+        return BT_STATUS_FAIL;
     }
     return BT_STATUS_SUCCESS;
 }
@@ -1049,7 +1050,6 @@ void btc_hf_client_cb_handler(btc_msg_t *msg)
                     param.cnum.type = ESP_HF_SUBSCRIBER_SERVICE_TYPE_UNKNOWN;
                 }
                 btc_hf_client_cb_to_app(ESP_HF_CLIENT_CNUM_EVT, &param);
-                break;
             } while (0);
             break;
         case BTA_HF_CLIENT_BTRH_EVT: