@@ -224,27 +224,36 @@ IOReturn CIntelBTPatcher::newHostDeviceRequest(void *that, IOService *provider,
             if (getKernelVersion() >= KernelVersion::Sequoia)
                 descriptor->complete(kIODirectionOut);
         }
-        hdr = (HciCommandHdr *)hciBuf;
-        if (getKernelVersion() < KernelVersion::Tahoe &&
+        if (hdrLen >= sizeof(HciCommandHdr))
+            hdr = reinterpret_cast<HciCommandHdr *>(hciBuf);
+        if (hdr && getKernelVersion() < KernelVersion::Tahoe &&
+            hdr->len == 7 && hdrLen >= sizeof(HciCommandHdr) + hdr->len &&
             hdr->opcode == HCI_OP_LE_SET_SCAN_PARAM && hdr->data[5] == 0x1) {
             if (!_randomAddressInit) {
                 randomAddressRequest.bmRequestType = makeDeviceRequestbmRequestType(kRequestDirectionOut, kRequestTypeClass, kRequestRecipientInterface);
                 randomAddressRequest.bRequest = 0xE0;
                 randomAddressRequest.wIndex = 0;
                 randomAddressRequest.wValue = 0;
-                randomAddressRequest.wLength = 9;
-                length = 9;
+                randomAddressRequest.wLength = sizeof(randomAddressHci);
                 if (writeHCIDescriptor == nullptr)
-                    writeHCIDescriptor = IOBufferMemoryDescriptor::withBytes(randomAddressHci, 9, kIODirectionInOut);
-                writeHCIDescriptor->prepare(kIODirectionInOut);
-                IOReturn ret = FunctionCast(newHostDeviceRequest, callbackIBTPatcher->oldHostDeviceRequest)(that, provider, randomAddressRequest, nullptr, writeHCIDescriptor, length, nullptr, timeout);
-                writeHCIDescriptor->complete(kIODirectionInOut);
+                    writeHCIDescriptor = IOBufferMemoryDescriptor::withBytes(randomAddressHci, sizeof(randomAddressHci), kIODirectionInOut);
+                if (writeHCIDescriptor == nullptr) {
+                    SYSLOG(DRV_NAME, "failed to allocate random address descriptor");
+                    return FunctionCast(newHostDeviceRequest, callbackIBTPatcher->oldHostDeviceRequest)(that, provider, request, data, descriptor, length, completion, timeout);
+                }
+                unsigned int randomAddressLength = sizeof(randomAddressHci);
+                IOReturn ret = writeHCIDescriptor->prepare(kIODirectionInOut);
+                if (ret == kIOReturnSuccess) {
+                    ret = FunctionCast(newHostDeviceRequest, callbackIBTPatcher->oldHostDeviceRequest)(that, provider, randomAddressRequest, nullptr, writeHCIDescriptor, randomAddressLength, nullptr, timeout);
+                    writeHCIDescriptor->complete(kIODirectionInOut);
+                }
                 const char *randAddressDump = _hexDumpHCIData((uint8_t *)randomAddressHci, 9);
                 if (randAddressDump) {
                     SYSLOG(DRV_NAME, "[PATCH] Sending Random Address HCI %d %s", ret, randAddressDump);
                     IOFree((void *)randAddressDump, 9 * 3 + 1);
                 }
-                _randomAddressInit = true;
+                if (ret == kIOReturnSuccess)
+                    _randomAddressInit = true;
                 SYSLOG(DRV_NAME, "[PATCH] Resend LE SCAN PARAM HCI %d", ret);
             }
         } else if (that == _hookDeviceInstance &&
@@ -259,9 +268,9 @@ IOReturn CIntelBTPatcher::newHostDeviceRequest(void *that, IOService *provider,
                 cancelRemoteFeatures(handle);
             return result;
         }
-    } else {
-        hdr = (HciCommandHdr *)data;
-        hdrLen = request.wLength - 3;
+    } else if (request.wLength >= sizeof(HciCommandHdr)) {
+        hdr = reinterpret_cast<HciCommandHdr *>(data);
+        hdrLen = request.wLength;
     }
     if (hdr) {
         // HCI reset, we need to send Random address again
@@ -429,24 +438,24 @@ void CIntelBTPatcher::captureIntelInterruptPipe(void *that, StandardUSB::Endpoin
     }
 }
 
-int CIntelBTPatcher::newInitPipe(void *that, StandardUSB::EndpointDescriptor const *descriptor,
+bool CIntelBTPatcher::newInitPipe(void *that, StandardUSB::EndpointDescriptor const *descriptor,
                                  StandardUSB::SuperSpeedEndpointCompanionDescriptor const *superDescriptor,
                                  AppleUSBHostController *controller, IOUSBHostDevice *device,
                                  IOUSBHostInterface *interface, unsigned char a7, unsigned short a8)
 {
-    int ret = FunctionCast(newInitPipe, callbackIBTPatcher->oldInitPipe)(that, descriptor, superDescriptor,
+    bool ret = FunctionCast(newInitPipe, callbackIBTPatcher->oldInitPipe)(that, descriptor, superDescriptor,
                                                                         controller, device, interface, a7, a8);
     if (ret)
         captureIntelInterruptPipe(that, descriptor, device, interface);
     return ret;
 }
 
-int CIntelBTPatcher::newInitPipeConfig(void *that, StandardUSB::EndpointDescriptor const *descriptor,
+bool CIntelBTPatcher::newInitPipeConfig(void *that, StandardUSB::EndpointDescriptor const *descriptor,
                                        StandardUSB::ConfigurationDescriptor const *configDescriptor,
                                        AppleUSBHostController *controller, IOUSBHostDevice *device,
                                        IOUSBHostInterface *interface, unsigned char a7, unsigned short a8)
 {
-    int ret = FunctionCast(newInitPipeConfig, callbackIBTPatcher->oldInitPipeConfig)(that, descriptor,
+    bool ret = FunctionCast(newInitPipeConfig, callbackIBTPatcher->oldInitPipeConfig)(that, descriptor,
                                                                                     configDescriptor, controller,
                                                                                     device, interface, a7, a8);
     if (ret)
 
@@ -68,8 +68,8 @@ class CIntelBTPatcher {
     static IOReturn newAsyncIO(void *that, IOMemoryDescriptor* dataBuffer, uint32_t dataBufferLength, IOUSBHostCompletion* completion, uint32_t completionTimeoutMs);
     static bool completeRemoteFeatures(uint16_t handle, bool success);
     static void cancelRemoteFeatures(uint16_t handle);
-    static int newInitPipe(void *that, StandardUSB::EndpointDescriptor const *descriptor, StandardUSB::SuperSpeedEndpointCompanionDescriptor const *superDescriptor,AppleUSBHostController *controller, IOUSBHostDevice *device, IOUSBHostInterface *interface, unsigned char, unsigned short);
-    static int newInitPipeConfig(void *that, StandardUSB::EndpointDescriptor const *descriptor, StandardUSB::ConfigurationDescriptor const *configDescriptor, AppleUSBHostController *controller, IOUSBHostDevice *device, IOUSBHostInterface *interface, unsigned char, unsigned short);
+    static bool newInitPipe(void *that, StandardUSB::EndpointDescriptor const *descriptor, StandardUSB::SuperSpeedEndpointCompanionDescriptor const *superDescriptor,AppleUSBHostController *controller, IOUSBHostDevice *device, IOUSBHostInterface *interface, unsigned char, unsigned short);
+    static bool newInitPipeConfig(void *that, StandardUSB::EndpointDescriptor const *descriptor, StandardUSB::ConfigurationDescriptor const *configDescriptor, AppleUSBHostController *controller, IOUSBHostDevice *device, IOUSBHostInterface *interface, unsigned char, unsigned short);
 
     mach_vm_address_t oldFindQueueRequest {};
     mach_vm_address_t oldHostDeviceRequest {};