diff --git a/feed/mt76-vendor/src/amnt.c b/feed/mt76-vendor/src/amnt.c
index 55eb071..653e785 100644
--- a/feed/mt76-vendor/src/amnt.c
+++ b/feed/mt76-vendor/src/amnt.c
@@ -3,13 +3,13 @@
 
 #include "mt76-vendor.h"
 
-static const struct nla_policy
+static struct nla_policy
 amnt_ctrl_policy[NUM_MTK_VENDOR_ATTRS_AMNT_CTRL] = {
 	[MTK_VENDOR_ATTR_AMNT_CTRL_SET] = {.type = NLA_NESTED },
 	[MTK_VENDOR_ATTR_AMNT_CTRL_DUMP] = { .type = NLA_NESTED },
 };
 
-static const struct nla_policy
+static struct nla_policy
 amnt_dump_policy[NUM_MTK_VENDOR_ATTRS_AMNT_DUMP] = {
 	[MTK_VENDOR_ATTR_AMNT_DUMP_INDEX] = {.type = NLA_U8 },
 	[MTK_VENDOR_ATTR_AMNT_DUMP_LEN] = { .type = NLA_U8 },
@@ -30,14 +30,23 @@
 		return -EINVAL;
 
 	tb1 = nla_nest_start(msg, MTK_VENDOR_ATTR_AMNT_CTRL_SET | NLA_F_NESTED);
+	if (!tb1)
+		return -ENOMEM;
+
 	nla_put_u8(msg, MTK_VENDOR_ATTR_AMNT_SET_INDEX, idx);
 
 	tb2 = nla_nest_start(msg, MTK_VENDOR_ATTR_AMNT_SET_MACADDR | NLA_F_NESTED);
+	if (!tb2) {
+		nla_nest_end(msg, tb1);
+		return -ENOMEM;
+	}
+
 	for (i = 0; i < ETH_ALEN; i++)
 		nla_put_u8(msg, i, a[i]);
 
 	nla_nest_end(msg, tb2);
 	nla_nest_end(msg, tb1);
+
 	return 0;
 }
 
@@ -165,4 +174,4 @@
 	unl_free(&unl);
 
 	return ret;
-}
\ No newline at end of file
+}
diff --git a/feed/mt76-vendor/src/capi.c b/feed/mt76-vendor/src/capi.c
index e86a9e1..91efbd8 100644
--- a/feed/mt76-vendor/src/capi.c
+++ b/feed/mt76-vendor/src/capi.c
@@ -8,8 +8,10 @@
 	char *val;
 
 	val = strchr(argv[0], '=');
-	if (val)
-		*(val++) = 0;
+	if (!val)
+		return -EINVAL;
+
+	*(val++) = 0;
 
 	if (!strncmp(argv[0], "he_gi", 5)) {
 		nla_put_u8(msg, MTK_VENDOR_ATTR_RFEATURE_CTRL_HE_GI, strtoul(val, NULL, 0));
@@ -65,8 +67,10 @@
 	char *val;
 
 	val = strchr(argv[0], '=');
-	if (val)
-		*(val++) = 0;
+	if (!val)
+		return -EINVAL;
+
+	*(val++) = 0;
 
 	if (!strncmp(argv[0], "fixed_mcs", 9)) {
 		nla_put_u8(msg, MTK_VENDOR_ATTR_WIRELESS_CTRL_FIXED_MCS, strtoul(val, NULL, 0));
diff --git a/feed/mt76-vendor/src/csi.c b/feed/mt76-vendor/src/csi.c
index 76da857..3c4c6b2 100644
--- a/feed/mt76-vendor/src/csi.c
+++ b/feed/mt76-vendor/src/csi.c
@@ -132,7 +132,7 @@
 
 		pos += snprintf(pos, MAX_BUF_SIZE, "%c", '[');
 
-		pos += snprintf(pos, MAX_BUF_SIZE, "%ld,", c->ts);
+		pos += snprintf(pos, MAX_BUF_SIZE, "%d,", c->ts);
 		pos += snprintf(pos, MAX_BUF_SIZE, "\"%02x%02x%02x%02x%02x%02x\",", c->ta[0], c->ta[1], c->ta[2], c->ta[3], c->ta[4], c->ta[5]);
 
 		pos += snprintf(pos, MAX_BUF_SIZE, "%d,", c->rssi);
@@ -171,11 +171,13 @@
 
 	fwrite("]", 1, 1, f);
 	fclose(f);
+
+	return 0;
 }
 
 int mt76_csi_dump(int idx, int argc, char **argv)
 {
-	int pkt_num, ret, i;
+	int pkt_num, ret = 0, i;
 	struct nl_msg *msg;
 	void *data;
 
@@ -227,8 +229,10 @@
 	void *data;
 
 	val = strchr(argv[0], '=');
-	if (val)
-		*(val++) = 0;
+	if (!val)
+		return -EINVAL;
+
+	*(val++) = 0;
 
 	if (!strncmp(argv[0], "ctrl", 4)) {
 		s1 = s2 = strdup(val);