diff --git a/components/bootloader_support/src/esp_image_format.c b/components/bootloader_support/src/esp_image_format.c
index 73c5810df4..979750f5af 100644
--- a/components/bootloader_support/src/esp_image_format.c
+++ b/components/bootloader_support/src/esp_image_format.c
@@ -789,7 +789,7 @@ static esp_err_t process_checksum(bootloader_sha256_handle_t sha_handle, uint32_
     length = length - unpadded_length;
 
     // Verify checksum
-    WORD_ALIGNED_ATTR uint8_t buf[16];
+    WORD_ALIGNED_ATTR uint8_t buf[16] = {0};
     if (!skip_check_checksum || sha_handle != NULL) {
         CHECK_ERR(bootloader_flash_read(data->start_addr + unpadded_length, buf, length, true));
     }
diff --git a/components/driver/gptimer.c b/components/driver/gptimer.c
index 0c51207eb2..6044d8523a 100644
--- a/components/driver/gptimer.c
+++ b/components/driver/gptimer.c
@@ -428,7 +428,7 @@ static esp_err_t gptimer_select_periph_clock(gptimer_t *timer, gptimer_clock_sou
     timer_ll_set_clock_prescale(timer->hal.dev, timer_id, prescale);
     timer->resolution_hz = counter_src_hz / prescale; // this is the real resolution
     if (timer->resolution_hz != resolution_hz) {
-        ESP_LOGW(TAG, "resolution lost, expect %ul, real %ul", resolution_hz, timer->resolution_hz);
+        ESP_LOGW(TAG, "resolution lost, expect %u, real %u", resolution_hz, timer->resolution_hz);
     }
     return ret;
 }
diff --git a/components/driver/i2s.c b/components/driver/i2s.c
index 5eafedf65b..7730f2b69a 100644
--- a/components/driver/i2s.c
+++ b/components/driver/i2s.c
@@ -1210,12 +1210,12 @@ static void i2s_mode_identify(i2s_port_t i2s_num, const i2s_config_t *i2s_config
 static esp_err_t i2s_config_transfer(i2s_port_t i2s_num, const i2s_config_t *i2s_config)
 {
     /* Convert legacy configuration into general part of slot and clock configuration */
-    i2s_slot_config_t slot_cfg;
+    i2s_slot_config_t slot_cfg = {};
     slot_cfg.mode = p_i2s[i2s_num]->mode;
     slot_cfg.data_bit_width = i2s_config->bits_per_sample;
     slot_cfg.slot_bit_width = (int)i2s_config->bits_per_chan < (int)i2s_config->bits_per_sample ?
                                 i2s_config->bits_per_sample : i2s_config->bits_per_chan;
-    i2s_clk_config_t clk_cfg;
+    i2s_clk_config_t clk_cfg = {};
     clk_cfg.sample_rate_hz = i2s_config->sample_rate;
     clk_cfg.mclk_multiple = i2s_config->mclk_multiple == 0 ? I2S_MCLK_MULTIPLE_256 : i2s_config->mclk_multiple;
     clk_cfg.clk_src = I2S_CLK_D2CLK;
diff --git a/components/driver/rmt.c b/components/driver/rmt.c
index 086c56ead0..397845ac8f 100644
--- a/components/driver/rmt.c
+++ b/components/driver/rmt.c
@@ -589,7 +589,7 @@ static esp_err_t rmt_internal_config(rmt_dev_t *dev, const rmt_config_t *rmt_par
     uint32_t rmt_source_clk_hz;
 
     ESP_RETURN_ON_FALSE(rmt_is_channel_number_valid(channel, mode), ESP_ERR_INVALID_ARG, TAG, RMT_CHANNEL_ERROR_STR);
-    ESP_RETURN_ON_FALSE(mem_cnt + channel <= 8 && mem_cnt > 0, ESP_ERR_INVALID_ARG, TAG, RMT_MEM_CNT_ERROR_STR);
+    ESP_RETURN_ON_FALSE(mem_cnt + channel <= SOC_RMT_CHANNELS_PER_GROUP && mem_cnt > 0, ESP_ERR_INVALID_ARG, TAG, RMT_MEM_CNT_ERROR_STR);
     ESP_RETURN_ON_FALSE(clk_div > 0, ESP_ERR_INVALID_ARG, TAG, RMT_CLK_DIV_ERROR_STR);
 
     if (mode == RMT_MODE_TX) {
@@ -726,7 +726,6 @@ esp_err_t rmt_fill_tx_items(rmt_channel_t channel, const rmt_item32_t *item, uin
     ESP_RETURN_ON_FALSE(item, ESP_ERR_INVALID_ARG, TAG, RMT_ADDR_ERROR_STR);
     ESP_RETURN_ON_FALSE(item_num > 0, ESP_ERR_INVALID_ARG, TAG, RMT_DRIVER_LENGTH_ERROR_STR);
 
-    /*Each block has 64 x 32 bits of data*/
     uint8_t mem_cnt = rmt_ll_tx_get_mem_blocks(rmt_contex.hal.regs, channel);
     ESP_RETURN_ON_FALSE(mem_cnt * RMT_MEM_ITEM_NUM >= item_num, ESP_ERR_INVALID_ARG, TAG, RMT_WR_MEM_OVF_ERROR_STR);
     rmt_fill_memory(channel, item, item_num, mem_offset);
@@ -746,22 +745,6 @@ esp_err_t rmt_isr_deregister(rmt_isr_handle_t handle)
     return esp_intr_free(handle);
 }
 
-static int IRAM_ATTR rmt_rx_get_mem_len_in_isr(rmt_channel_t channel)
-{
-    int block_num = rmt_ll_rx_get_mem_blocks(rmt_contex.hal.regs, channel);
-    int item_block_len = block_num * RMT_MEM_ITEM_NUM;
-    volatile rmt_item32_t *data = (rmt_item32_t *)RMTMEM.chan[RMT_ENCODE_RX_CHANNEL(channel)].data32;
-    int idx;
-    for (idx = 0; idx < item_block_len; idx++) {
-        if (data[idx].duration0 == 0) {
-            return idx;
-        } else if (data[idx].duration1 == 0) {
-            return idx + 1;
-        }
-    }
-    return idx;
-}
-
 static void IRAM_ATTR rmt_driver_isr_default(void *arg)
 {
     uint32_t status = 0;
@@ -849,7 +832,7 @@ static void IRAM_ATTR rmt_driver_isr_default(void *arg)
         rmt_obj_t *p_rmt = p_rmt_obj[RMT_ENCODE_RX_CHANNEL(channel)];
         if (p_rmt) {
             rmt_ll_rx_enable(rmt_contex.hal.regs, channel, false);
-            int item_len = rmt_rx_get_mem_len_in_isr(channel);
+            int item_len = rmt_ll_rx_get_memory_writer_offset(rmt_contex.hal.regs, channel);
             rmt_ll_rx_set_mem_owner(rmt_contex.hal.regs, channel, RMT_LL_MEM_OWNER_SW);
             if (p_rmt->rx_buf) {
                 addr = (rmt_item32_t *)RMTMEM.chan[RMT_ENCODE_RX_CHANNEL(channel)].data32;
@@ -1135,6 +1118,8 @@ esp_err_t rmt_write_items(rmt_channel_t channel, const rmt_item32_t *rmt_item, i
     ESP_RETURN_ON_FALSE(p_rmt_obj[channel], ESP_FAIL, TAG, RMT_DRIVER_ERROR_STR);
     ESP_RETURN_ON_FALSE(rmt_item, ESP_FAIL, TAG, RMT_ADDR_ERROR_STR);
     ESP_RETURN_ON_FALSE(item_num > 0, ESP_ERR_INVALID_ARG, TAG, RMT_DRIVER_LENGTH_ERROR_STR);
+    uint32_t mem_blocks = rmt_ll_tx_get_mem_blocks(rmt_contex.hal.regs, channel);
+    ESP_RETURN_ON_FALSE(mem_blocks + channel <= SOC_RMT_CHANNELS_PER_GROUP, ESP_ERR_INVALID_STATE, TAG, RMT_MEM_CNT_ERROR_STR);
 #if CONFIG_SPIRAM_USE_MALLOC
     if (p_rmt_obj[channel]->intr_alloc_flags & ESP_INTR_FLAG_IRAM) {
         if (!esp_ptr_internal(rmt_item)) {
@@ -1144,9 +1129,8 @@ esp_err_t rmt_write_items(rmt_channel_t channel, const rmt_item32_t *rmt_item, i
     }
 #endif
     rmt_obj_t *p_rmt = p_rmt_obj[channel];
-    int block_num = rmt_ll_tx_get_mem_blocks(rmt_contex.hal.regs, channel);
-    int item_block_len = block_num * RMT_MEM_ITEM_NUM;
-    int item_sub_len = block_num * RMT_MEM_ITEM_NUM / 2;
+    int item_block_len = mem_blocks * RMT_MEM_ITEM_NUM;
+    int item_sub_len = mem_blocks * RMT_MEM_ITEM_NUM / 2;
     int len_rem = item_num;
     xSemaphoreTake(p_rmt->tx_sem, portMAX_DELAY);
     // fill the memory block first
@@ -1222,8 +1206,9 @@ esp_err_t rmt_translator_init(rmt_channel_t channel, sample_to_rmt_t fn)
     ESP_RETURN_ON_FALSE(fn, ESP_ERR_INVALID_ARG, TAG, RMT_TRANSLATOR_NULL_STR);
     ESP_RETURN_ON_FALSE(RMT_IS_TX_CHANNEL(channel), ESP_ERR_INVALID_ARG, TAG, RMT_CHANNEL_ERROR_STR);
     ESP_RETURN_ON_FALSE(p_rmt_obj[channel], ESP_FAIL, TAG, RMT_DRIVER_ERROR_STR);
-    const uint32_t block_size = rmt_ll_tx_get_mem_blocks(rmt_contex.hal.regs, channel) *
-                                RMT_MEM_ITEM_NUM * sizeof(rmt_item32_t);
+    uint32_t mem_blocks = rmt_ll_tx_get_mem_blocks(rmt_contex.hal.regs, channel);
+    ESP_RETURN_ON_FALSE(mem_blocks + channel <= SOC_RMT_CHANNELS_PER_GROUP, ESP_ERR_INVALID_STATE, TAG, RMT_MEM_CNT_ERROR_STR);
+    const uint32_t block_size = mem_blocks * RMT_MEM_ITEM_NUM * sizeof(rmt_item32_t);
     if (p_rmt_obj[channel]->tx_buf == NULL) {
 #if !CONFIG_SPIRAM_USE_MALLOC
         p_rmt_obj[channel]->tx_buf = (rmt_item32_t *)malloc(block_size);
@@ -1273,6 +1258,8 @@ esp_err_t rmt_write_sample(rmt_channel_t channel, const uint8_t *src, size_t src
     ESP_RETURN_ON_FALSE(RMT_IS_TX_CHANNEL(channel), ESP_ERR_INVALID_ARG, TAG, RMT_CHANNEL_ERROR_STR);
     ESP_RETURN_ON_FALSE(p_rmt_obj[channel], ESP_FAIL, TAG, RMT_DRIVER_ERROR_STR);
     ESP_RETURN_ON_FALSE(p_rmt_obj[channel]->sample_to_rmt, ESP_FAIL, TAG, RMT_TRANSLATOR_UNINIT_STR);
+    uint32_t mem_blocks = rmt_ll_tx_get_mem_blocks(rmt_contex.hal.regs, channel);
+    ESP_RETURN_ON_FALSE(mem_blocks + channel <= SOC_RMT_CHANNELS_PER_GROUP, ESP_ERR_INVALID_STATE, TAG, RMT_MEM_CNT_ERROR_STR);
 #if CONFIG_SPIRAM_USE_MALLOC
     if (p_rmt_obj[channel]->intr_alloc_flags & ESP_INTR_FLAG_IRAM) {
         if (!esp_ptr_internal(src)) {
@@ -1283,7 +1270,7 @@ esp_err_t rmt_write_sample(rmt_channel_t channel, const uint8_t *src, size_t src
 #endif
     size_t translated_size = 0;
     rmt_obj_t *p_rmt = p_rmt_obj[channel];
-    const uint32_t item_block_len = rmt_ll_tx_get_mem_blocks(rmt_contex.hal.regs, channel) * RMT_MEM_ITEM_NUM;
+    const uint32_t item_block_len = mem_blocks * RMT_MEM_ITEM_NUM;
     const uint32_t item_sub_len = item_block_len / 2;
     xSemaphoreTake(p_rmt->tx_sem, portMAX_DELAY);
     p_rmt->sample_to_rmt((void *)src, p_rmt->tx_buf, src_size, item_block_len, &translated_size, &p_rmt->tx_len_rem);
diff --git a/components/driver/spi_master.c b/components/driver/spi_master.c
index 505d7a4989..ab37526860 100644
--- a/components/driver/spi_master.c
+++ b/components/driver/spi_master.c
@@ -649,6 +649,8 @@ static void SPI_MASTER_ISR_ATTR spi_intr(void *arg)
             // We stay in the ISR to deal with those transactions of desired device, otherwise nothing will be done, check whether we need to resume some other tasks, or just quit the ISR
             resume_task = spi_bus_lock_bg_check_dev_acq(lock, &desired_dev);
         }
+        // sanity check
+        assert(desired_dev);
 
         if (!resume_task) {
             bool dev_has_req = spi_bus_lock_bg_check_dev_req(desired_dev);
@@ -733,7 +735,8 @@ static SPI_MASTER_ISR_ATTR void uninstall_priv_desc(spi_trans_priv_t* trans_buf)
         free((void *)trans_buf->buffer_to_send); //force free, ignore const
     }
     // copy data from temporary DMA-capable buffer back to IRAM buffer and free the temporary one.
-    if ((void *)trans_buf->buffer_to_rcv != &trans_desc->rx_data[0] &&
+    if (trans_buf->buffer_to_rcv &&
+        (void *)trans_buf->buffer_to_rcv != &trans_desc->rx_data[0] &&
         trans_buf->buffer_to_rcv != trans_desc->rx_buffer) { // NOLINT(clang-analyzer-unix.Malloc)
         if (trans_desc->flags & SPI_TRANS_USE_RXDATA) {
             memcpy((uint8_t *) & trans_desc->rx_data[0], trans_buf->buffer_to_rcv, (trans_desc->rxlength + 7) / 8);
diff --git a/components/driver/spi_slave.c b/components/driver/spi_slave.c
index aa4f88bf1f..ca7409a72d 100644
--- a/components/driver/spi_slave.c
+++ b/components/driver/spi_slave.c
@@ -370,6 +370,9 @@ static void SPI_SLAVE_ISR_ATTR spi_intr(void *arg)
     //Grab next transaction
     r = xQueueReceiveFromISR(host->trans_queue, &trans, &do_yield);
     if (r) {
+        // sanity check
+        assert(trans);
+
         //enable the interrupt again if there is packet to send
         esp_intr_enable(host->intr);