diff --git a/components/bt/controller/esp32c6/Kconfig.in b/components/bt/controller/esp32c6/Kconfig.in
index 70165672f6..8be6745af1 100644
--- a/components/bt/controller/esp32c6/Kconfig.in
+++ b/components/bt/controller/esp32c6/Kconfig.in
@@ -1,6 +1,5 @@
 
 menu "HCI Config"
-
     choice BT_LE_HCI_INTERFACE
         prompt "HCI mode"
         default BT_LE_HCI_INTERFACE_USE_RAM
@@ -434,6 +433,10 @@ menu "Controller debug features"
         default n
         help
             Retain scene with GDB to capture info, requires disabling WDT (CONFIG_ESP_INT_WDT, CONFIG_ESP_TASK_WDT_EN).
+
+    config BT_LE_PTR_CHECK_ENABLED
+        bool "Enable boundary check for internal memory"
+        default n
 endmenu
 
 config BT_LE_LL_RESOLV_LIST_SIZE
diff --git a/components/bt/controller/esp32c6/ble.c b/components/bt/controller/esp32c6/ble.c
index 7b50ca8ce9..f93f15e9b8 100644
--- a/components/bt/controller/esp32c6/ble.c
+++ b/components/bt/controller/esp32c6/ble.c
@@ -38,9 +38,14 @@ void pcl_stack_enableSetRssiThreshVsCmd(bool en);
 void chanSel_stack_enableSetCsaVsCmd(bool en);
 void log_stack_enableLogsRelatedVsCmd(bool en);
 void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+void winWiden_stack_enableSetConstPeerScaVsCmd(bool en);
+#if CONFIG_IDF_TARGET_ESP32C61_ECO3
+void conn_stack_enableSetPrefTxRxCntVsCmd(bool en);
+#endif // CONFIG_IDF_TARGET_ESP32C61_ECO3
 
 void adv_stack_enableScanReqRxdVsEvent(bool en);
 void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+void sleep_stack_enableWakeupVsEvent(bool en);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
 /* Local functions definition
@@ -57,12 +62,20 @@ void ble_stack_enableVsCmds(bool en)
     chanSel_stack_enableSetCsaVsCmd(en);
     log_stack_enableLogsRelatedVsCmd(en);
     hci_stack_enableSetVsEvtMaskVsCmd(en);
+    winWiden_stack_enableSetConstPeerScaVsCmd(en);
+#if CONFIG_IDF_TARGET_ESP32C61_ECO3
+    conn_stack_enableSetPrefTxRxCntVsCmd(en);
+#endif // CONFIG_IDF_TARGET_ESP32C61_ECO3
 }
 
 void ble_stack_enableVsEvents(bool en)
 {
     adv_stack_enableScanReqRxdVsEvent(en);
     conn_stack_enableChanMapUpdCompVsEvent(en);
+
+#if CONFIG_BT_LE_SLEEP_ENABLE
+    sleep_stack_enableWakeupVsEvent(en);
+#endif // CONFIG_BT_LE_SLEEP_ENABLE
 }
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
diff --git a/components/bt/controller/esp32c6/esp_bt_cfg.h b/components/bt/controller/esp32c6/esp_bt_cfg.h
index 3d8edd55de..6621c28cb4 100644
--- a/components/bt/controller/esp32c6/esp_bt_cfg.h
+++ b/components/bt/controller/esp32c6/esp_bt_cfg.h
@@ -204,6 +204,12 @@ extern "C" {
 #define DEFAULT_BT_LE_VHCI_ENABLED      (0)
 #endif
 
+#ifdef CONFIG_BT_LE_PTR_CHECK_ENABLED
+#define DEFAULT_BT_LE_PTR_CHECK_ENABLED (CONFIG_BT_LE_PTR_CHECK_ENABLED)
+#else
+#define DEFAULT_BT_LE_PTR_CHECK_ENABLED (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else
diff --git a/components/bt/controller/esp32h2/Kconfig.in b/components/bt/controller/esp32h2/Kconfig.in
index d270ca4913..c3aa384262 100644
--- a/components/bt/controller/esp32h2/Kconfig.in
+++ b/components/bt/controller/esp32h2/Kconfig.in
@@ -1,6 +1,5 @@
 
 menu "HCI Config"
-
     choice BT_LE_HCI_INTERFACE
         prompt "HCI mode"
         default BT_LE_HCI_INTERFACE_USE_RAM
@@ -425,6 +424,10 @@ menu "Controller debug features"
         default n
         help
             Retain scene with GDB to capture info, requires disabling WDT (CONFIG_ESP_INT_WDT, CONFIG_ESP_TASK_WDT_EN).
+
+    config BT_LE_PTR_CHECK_ENABLED
+        bool "Enable boundary check for internal memory"
+        default n
 endmenu
 
 config BT_LE_LL_RESOLV_LIST_SIZE
diff --git a/components/bt/controller/esp32h2/ble.c b/components/bt/controller/esp32h2/ble.c
index 7b50ca8ce9..caa8d85543 100644
--- a/components/bt/controller/esp32h2/ble.c
+++ b/components/bt/controller/esp32h2/ble.c
@@ -38,9 +38,11 @@ void pcl_stack_enableSetRssiThreshVsCmd(bool en);
 void chanSel_stack_enableSetCsaVsCmd(bool en);
 void log_stack_enableLogsRelatedVsCmd(bool en);
 void hci_stack_enableSetVsEvtMaskVsCmd(bool en);
+void winWiden_stack_enableSetConstPeerScaVsCmd(bool en);
 
 void adv_stack_enableScanReqRxdVsEvent(bool en);
 void conn_stack_enableChanMapUpdCompVsEvent(bool en);
+void sleep_stack_enableWakeupVsEvent(bool en);
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
 /* Local functions definition
@@ -57,12 +59,17 @@ void ble_stack_enableVsCmds(bool en)
     chanSel_stack_enableSetCsaVsCmd(en);
     log_stack_enableLogsRelatedVsCmd(en);
     hci_stack_enableSetVsEvtMaskVsCmd(en);
+    winWiden_stack_enableSetConstPeerScaVsCmd(en);
 }
 
 void ble_stack_enableVsEvents(bool en)
 {
     adv_stack_enableScanReqRxdVsEvent(en);
     conn_stack_enableChanMapUpdCompVsEvent(en);
+
+#if CONFIG_BT_LE_SLEEP_ENABLE
+    sleep_stack_enableWakeupVsEvent(en);
+#endif // CONFIG_BT_LE_SLEEP_ENABLE
 }
 #endif // (CONFIG_BT_NIMBLE_ENABLED || CONFIG_BT_BLUEDROID_ENABLED)
 
diff --git a/components/bt/controller/esp32h2/esp_bt_cfg.h b/components/bt/controller/esp32h2/esp_bt_cfg.h
index 3d8edd55de..6621c28cb4 100644
--- a/components/bt/controller/esp32h2/esp_bt_cfg.h
+++ b/components/bt/controller/esp32h2/esp_bt_cfg.h
@@ -204,6 +204,12 @@ extern "C" {
 #define DEFAULT_BT_LE_VHCI_ENABLED      (0)
 #endif
 
+#ifdef CONFIG_BT_LE_PTR_CHECK_ENABLED
+#define DEFAULT_BT_LE_PTR_CHECK_ENABLED (CONFIG_BT_LE_PTR_CHECK_ENABLED)
+#else
+#define DEFAULT_BT_LE_PTR_CHECK_ENABLED (0)
+#endif
+
 #ifdef CONFIG_BT_LE_SLEEP_ENABLE
 #define NIMBLE_SLEEP_ENABLE CONFIG_BT_LE_SLEEP_ENABLE
 #else
diff --git a/components/bt/controller/lib_esp32c6/esp32c6-bt-lib b/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
index b75747061f..246541ab93 160000
--- a/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
+++ b/components/bt/controller/lib_esp32c6/esp32c6-bt-lib
@@ -1 +1 @@
-Subproject commit b75747061f79a6eb070b5b0f96ebda79bffee485
+Subproject commit 246541ab93e853eba1591784a5253b219c0414f9
diff --git a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
index cd36ec849c..a3192174a9 160000
--- a/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
+++ b/components/bt/controller/lib_esp32h2/esp32h2-bt-lib
@@ -1 +1 @@
-Subproject commit cd36ec849cbfc8cef8dd48228ca70fffc1e240a3
+Subproject commit a3192174a9aef015a9ceca983acdb9fd1a198445
diff --git a/components/bt/include/esp32c6/include/esp_bt.h b/components/bt/include/esp32c6/include/esp_bt.h
index 27b9fd16b3..e6e1dc4eba 100644
--- a/components/bt/include/esp32c6/include/esp_bt.h
+++ b/components/bt/include/esp32c6/include/esp_bt.h
@@ -223,6 +223,7 @@ typedef struct {
                                                         - 0 - Disable (default)
                                                         - 1 - Enable */
     uint8_t vhci_enabled;                            /*!< VHCI mode is enabled */
+    uint8_t ptr_check_enabled;                       /*!< Enable boundary check for internal memory. */
     uint32_t config_magic;                           /*!< Magic number for configuration validation */
 } esp_bt_controller_config_t;
 
@@ -278,6 +279,7 @@ typedef struct {
     .ble_chan_ass_en            = DEFAULT_BT_LE_CTRL_CHAN_ASS_EN,                       \
     .ble_data_lenth_zero_aux    = DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX,          \
     .vhci_enabled               = DEFAULT_BT_LE_VHCI_ENABLED,                           \
+    .ptr_check_enabled          = DEFAULT_BT_LE_PTR_CHECK_ENABLED,                      \
     .config_magic = CONFIG_MAGIC,                                                       \
 }
 
diff --git a/components/bt/include/esp32h2/include/esp_bt.h b/components/bt/include/esp32h2/include/esp_bt.h
index 9a7545b25c..6b412834c0 100644
--- a/components/bt/include/esp32h2/include/esp_bt.h
+++ b/components/bt/include/esp32h2/include/esp_bt.h
@@ -227,6 +227,7 @@ typedef struct {
                                                         - 0 - Disable (default)
                                                         - 1 - Enable */
     uint8_t vhci_enabled;                           /*!< VHCI is enabled  */
+    uint8_t ptr_check_enabled;                      /*!< Enable boundary check for internal memory. */
     uint32_t config_magic;                          /*!< Configuration magic value */
 } esp_bt_controller_config_t;
 
@@ -282,6 +283,7 @@ typedef struct {
     .ble_chan_ass_en            = DEFAULT_BT_LE_CTRL_CHAN_ASS_EN,                       \
     .ble_data_lenth_zero_aux    = DEFAULT_BT_LE_CTRL_ADV_DATA_LENGTH_ZERO_AUX,          \
     .vhci_enabled               = DEFAULT_BT_LE_VHCI_ENABLED,                           \
+    .ptr_check_enabled          = DEFAULT_BT_LE_PTR_CHECK_ENABLED,                      \
     .config_magic = CONFIG_MAGIC,                                                       \
 }