diff --git a/tests/api.c b/tests/api.c
index b22fff53d..20b9dd7c6 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -14879,7 +14879,7 @@ static void test_wc_PKCS7_Init (void)
 static void test_wc_PKCS7_InitWithCert (void)
 {
 #if defined(HAVE_PKCS7)
-    PKCS7       pkcs7;
+    PKCS7*       pkcs7;
 
 #ifndef NO_RSA
     #if defined(USE_CERT_BUFFERS_2048)
@@ -14923,24 +14923,26 @@ static void test_wc_PKCS7_InitWithCert (void)
         #error PKCS7 requires ECC or RSA
 #endif
     printf(testingFmt, "wc_PKCS7_InitWithCert()");
-    /* If initialization is not successful, it's free'd in init func. */
-    pkcs7.isDynamic = 0;
-    AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, (byte*)cert, (word32)certSz), 0);
 
-    wc_PKCS7_Free(&pkcs7);
+    AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
+    /* If initialization is not successful, it's free'd in init func. */
+    AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, (byte*)cert, (word32)certSz), 0);
+
+    wc_PKCS7_Free(pkcs7);
+    AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
 
     /* Valid initialization usage. */
-    AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, NULL, 0), 0);
+    AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, 0), 0);
 
     /* Pass in bad args. No need free for null checks, free at end.*/
     AssertIntEQ(wc_PKCS7_InitWithCert(NULL, (byte*)cert, (word32)certSz),
                                                            BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, NULL, (word32)certSz),
+    AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, (word32)certSz),
                                                       BAD_FUNC_ARG);
 
     printf(resultFmt, passed);
 
-    wc_PKCS7_Free(&pkcs7);
+    wc_PKCS7_Free(pkcs7);
 #endif
 } /* END test_wc_PKCS7_InitWithCert */
 
@@ -14951,7 +14953,7 @@ static void test_wc_PKCS7_InitWithCert (void)
 static void test_wc_PKCS7_EncodeData (void)
 {
 #if defined(HAVE_PKCS7)
-    PKCS7       pkcs7;
+    PKCS7*      pkcs7;
     byte        output[FOURK_BUF];
     byte        data[] = "My encoded DER cert.";
 
@@ -15022,29 +15024,29 @@ static void test_wc_PKCS7_EncodeData (void)
 
     XMEMSET(output, 0, sizeof(output));
 
-    pkcs7.isDynamic = 0;
-    AssertIntEQ(wc_PKCS7_Init(&pkcs7, HEAP_HINT, INVALID_DEVID), 0);
+    AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
+    AssertIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, INVALID_DEVID), 0);
 
-    AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, (byte*)cert, certSz), 0);
+    AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, (byte*)cert, certSz), 0);
 
     printf(testingFmt, "wc_PKCS7_EncodeData()");
 
-    pkcs7.content = data;
-    pkcs7.contentSz = sizeof(data);
-    pkcs7.privateKey = key;
-    pkcs7.privateKeySz = keySz;
-    AssertIntGT(wc_PKCS7_EncodeData(&pkcs7, output, (word32)sizeof(output)), 0);
+    pkcs7->content = data;
+    pkcs7->contentSz = sizeof(data);
+    pkcs7->privateKey = key;
+    pkcs7->privateKeySz = keySz;
+    AssertIntGT(wc_PKCS7_EncodeData(pkcs7, output, (word32)sizeof(output)), 0);
 
     /* Test bad args. */
     AssertIntEQ(wc_PKCS7_EncodeData(NULL, output, (word32)sizeof(output)),
                                                             BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeData(&pkcs7, NULL, (word32)sizeof(output)),
+    AssertIntEQ(wc_PKCS7_EncodeData(pkcs7, NULL, (word32)sizeof(output)),
                                                             BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeData(&pkcs7, output, 5), BUFFER_E);
+    AssertIntEQ(wc_PKCS7_EncodeData(pkcs7, output, 5), BUFFER_E);
 
     printf(resultFmt, passed);
 
-    wc_PKCS7_Free(&pkcs7);
+    wc_PKCS7_Free(pkcs7);
 #endif
 }  /* END test_wc_PKCS7_EncodeData */
 
@@ -15055,7 +15057,7 @@ static void test_wc_PKCS7_EncodeData (void)
 static void test_wc_PKCS7_EncodeSignedData(void)
 {
 #if defined(HAVE_PKCS7)
-    PKCS7       pkcs7;
+    PKCS7*      pkcs7;
     WC_RNG      rng;
     byte        output[FOURK_BUF];
     byte        badOut[0];
@@ -15130,37 +15132,39 @@ static void test_wc_PKCS7_EncodeSignedData(void)
     XMEMSET(output, 0, outputSz);
     AssertIntEQ(wc_InitRng(&rng), 0);
 
-    AssertIntEQ(wc_PKCS7_Init(&pkcs7, HEAP_HINT, INVALID_DEVID), 0);
+    AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
+    AssertIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, INVALID_DEVID), 0);
 
-    AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, cert, certSz), 0);
+    AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, cert, certSz), 0);
 
     printf(testingFmt, "wc_PKCS7_EncodeSignedData()");
 
-    pkcs7.content = data;
-    pkcs7.contentSz = (word32)sizeof(data);
-    pkcs7.privateKey = key;
-    pkcs7.privateKeySz = (word32)sizeof(key);
-    pkcs7.encryptOID = RSAk;
-    pkcs7.hashOID = SHAh;
-    pkcs7.rng = &rng;
+    pkcs7->content = data;
+    pkcs7->contentSz = (word32)sizeof(data);
+    pkcs7->privateKey = key;
+    pkcs7->privateKeySz = (word32)sizeof(key);
+    pkcs7->encryptOID = RSAk;
+    pkcs7->hashOID = SHAh;
+    pkcs7->rng = &rng;
 
-    AssertIntGT(wc_PKCS7_EncodeSignedData(&pkcs7, output, outputSz), 0);
+    AssertIntGT(wc_PKCS7_EncodeSignedData(pkcs7, output, outputSz), 0);
 
-    wc_PKCS7_Free(&pkcs7);
-    AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, NULL, 0), 0);
-    AssertIntEQ(wc_PKCS7_VerifySignedData(&pkcs7, output, outputSz), 0);
+    wc_PKCS7_Free(pkcs7);
+    AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
+    AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, 0), 0);
+    AssertIntEQ(wc_PKCS7_VerifySignedData(pkcs7, output, outputSz), 0);
 
     /* Pass in bad args. */
     AssertIntEQ(wc_PKCS7_EncodeSignedData(NULL, output, outputSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeSignedData(&pkcs7, NULL, outputSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeSignedData(&pkcs7, badOut,
+    AssertIntEQ(wc_PKCS7_EncodeSignedData(pkcs7, NULL, outputSz), BAD_FUNC_ARG);
+    AssertIntEQ(wc_PKCS7_EncodeSignedData(pkcs7, badOut,
                                 badOutSz), BAD_FUNC_ARG);
-    pkcs7.hashOID = 0; /* bad hashOID */
-    AssertIntEQ(wc_PKCS7_EncodeSignedData(&pkcs7, output, outputSz), BAD_FUNC_ARG);
+    pkcs7->hashOID = 0; /* bad hashOID */
+    AssertIntEQ(wc_PKCS7_EncodeSignedData(pkcs7, output, outputSz), BAD_FUNC_ARG);
 
     printf(resultFmt, passed);
 
-    wc_PKCS7_Free(&pkcs7);
+    wc_PKCS7_Free(pkcs7);
     wc_FreeRng(&rng);
 
 #endif
@@ -15173,7 +15177,7 @@ static void test_wc_PKCS7_EncodeSignedData_ex(void)
 {
 #if defined(HAVE_PKCS7)
     int         ret, i;
-    PKCS7       pkcs7;
+    PKCS7*      pkcs7;
     WC_RNG      rng;
     byte        outputHead[FOURK_BUF/2];
     byte        outputFoot[FOURK_BUF/2];
@@ -15257,19 +15261,20 @@ static void test_wc_PKCS7_EncodeSignedData_ex(void)
     XMEMSET(outputFoot, 0, outputFootSz);
     AssertIntEQ(wc_InitRng(&rng), 0);
 
-    AssertIntEQ(wc_PKCS7_Init(&pkcs7, HEAP_HINT, INVALID_DEVID), 0);
+    AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
+    AssertIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, INVALID_DEVID), 0);
 
-    AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, cert, certSz), 0);
+    AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, cert, certSz), 0);
 
     printf(testingFmt, "wc_PKCS7_EncodeSignedData()");
 
-    pkcs7.content = NULL; /* not used for ex */
-    pkcs7.contentSz = (word32)sizeof(data);
-    pkcs7.privateKey = key;
-    pkcs7.privateKeySz = (word32)sizeof(key);
-    pkcs7.encryptOID = RSAk;
-    pkcs7.hashOID = SHAh;
-    pkcs7.rng = &rng;
+    pkcs7->content = NULL; /* not used for ex */
+    pkcs7->contentSz = (word32)sizeof(data);
+    pkcs7->privateKey = key;
+    pkcs7->privateKeySz = (word32)sizeof(key);
+    pkcs7->encryptOID = RSAk;
+    pkcs7->hashOID = SHAh;
+    pkcs7->rng = &rng;
 
     /* calculate hash for content */
     ret = wc_HashInit(&hash, hashType);
@@ -15283,20 +15288,21 @@ static void test_wc_PKCS7_EncodeSignedData_ex(void)
     AssertIntEQ(ret, 0);
 
     /* Perform PKCS7 sign using hash directly */
-    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(&pkcs7, hashBuf, hashSz,
+    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(pkcs7, hashBuf, hashSz,
         outputHead, &outputHeadSz, outputFoot, &outputFootSz), 0);
     AssertIntGT(outputHeadSz, 0);
     AssertIntGT(outputFootSz, 0);
 
-    wc_PKCS7_Free(&pkcs7);
-    AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, NULL, 0), 0);
+    wc_PKCS7_Free(pkcs7);
+    AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
+    AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, 0), 0);
 
     /* required parameter even on verify when using _ex */
-    pkcs7.contentSz = (word32)sizeof(data);
-    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(&pkcs7, hashBuf, hashSz,
+    pkcs7->contentSz = (word32)sizeof(data);
+    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(pkcs7, hashBuf, hashSz,
         outputHead, outputHeadSz, outputFoot, outputFootSz), 0);
 
-    wc_PKCS7_Free(&pkcs7);
+    wc_PKCS7_Free(pkcs7);
 
     /* assembly complete PKCS7 sign and use normal verify */
     {
@@ -15310,48 +15316,49 @@ static void test_wc_PKCS7_EncodeSignedData_ex(void)
         XMEMCPY(&output[outputSz], outputFoot, outputFootSz);
         outputSz += outputFootSz;
 
-        AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, NULL, 0), 0);
-        AssertIntEQ(wc_PKCS7_VerifySignedData(&pkcs7, output, outputSz), 0);
+        AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
+        AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, 0), 0);
+        AssertIntEQ(wc_PKCS7_VerifySignedData(pkcs7, output, outputSz), 0);
         XFREE(output, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
     }
 
     /* Pass in bad args. */
     AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(NULL, hashBuf, hashSz, outputHead,
         &outputHeadSz, outputFoot, &outputFootSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(&pkcs7, NULL, hashSz, outputHead,
+    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(pkcs7, NULL, hashSz, outputHead,
         &outputHeadSz, outputFoot, &outputFootSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(&pkcs7, hashBuf, 0, outputHead,
+    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(pkcs7, hashBuf, 0, outputHead,
         &outputHeadSz, outputFoot, &outputFootSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(&pkcs7, hashBuf, hashSz, NULL,
+    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(pkcs7, hashBuf, hashSz, NULL,
         &outputHeadSz, outputFoot, &outputFootSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(&pkcs7, hashBuf, hashSz,
+    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(pkcs7, hashBuf, hashSz,
         outputHead, NULL, outputFoot, &outputFootSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(&pkcs7, hashBuf, hashSz,
+    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(pkcs7, hashBuf, hashSz,
         outputHead, &outputHeadSz, NULL, &outputFootSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(&pkcs7, hashBuf, hashSz,
+    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(pkcs7, hashBuf, hashSz,
         outputHead, &outputHeadSz, outputFoot, NULL), BAD_FUNC_ARG);
-    pkcs7.hashOID = 0; /* bad hashOID */
-    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(&pkcs7, hashBuf, hashSz,
+    pkcs7->hashOID = 0; /* bad hashOID */
+    AssertIntEQ(wc_PKCS7_EncodeSignedData_ex(pkcs7, hashBuf, hashSz,
         outputHead, &outputHeadSz, outputFoot, &outputFootSz), BAD_FUNC_ARG);
 
     AssertIntEQ(wc_PKCS7_VerifySignedData_ex(NULL, hashBuf, hashSz, outputHead,
         outputHeadSz, outputFoot, outputFootSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(&pkcs7, NULL, hashSz, outputHead,
+    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(pkcs7, NULL, hashSz, outputHead,
         outputHeadSz, outputFoot, outputFootSz), ASN_PARSE_E);
-    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(&pkcs7, hashBuf, 0, outputHead,
+    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(pkcs7, hashBuf, 0, outputHead,
         outputHeadSz, outputFoot, outputFootSz), ASN_PARSE_E);
-    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(&pkcs7, hashBuf, hashSz, NULL,
+    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(pkcs7, hashBuf, hashSz, NULL,
         outputHeadSz, outputFoot, outputFootSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(&pkcs7, hashBuf, hashSz,
+    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(pkcs7, hashBuf, hashSz,
         outputHead, 0, outputFoot, outputFootSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(&pkcs7, hashBuf, hashSz,
+    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(pkcs7, hashBuf, hashSz,
         outputHead, outputHeadSz, NULL, outputFootSz), ASN_PARSE_E);
-    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(&pkcs7, hashBuf, hashSz,
+    AssertIntEQ(wc_PKCS7_VerifySignedData_ex(pkcs7, hashBuf, hashSz,
         outputHead, outputHeadSz, outputFoot, 0), ASN_PARSE_E);
 
     printf(resultFmt, passed);
 
-    wc_PKCS7_Free(&pkcs7);
+    wc_PKCS7_Free(pkcs7);
     wc_FreeRng(&rng);
 
 #endif
@@ -15364,7 +15371,7 @@ static void test_wc_PKCS7_EncodeSignedData_ex(void)
 static void test_wc_PKCS7_VerifySignedData(void)
 {
 #if defined(HAVE_PKCS7)
-    PKCS7       pkcs7;
+    PKCS7*      pkcs7;
     WC_RNG      rng;
     byte        output[FOURK_BUF];
     byte        badOut[0];
@@ -15439,34 +15446,36 @@ static void test_wc_PKCS7_VerifySignedData(void)
     XMEMSET(output, 0, outputSz);
     AssertIntEQ(wc_InitRng(&rng), 0);
 
-    AssertIntEQ(wc_PKCS7_Init(&pkcs7, HEAP_HINT, INVALID_DEVID), 0);
+    AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
+    AssertIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, INVALID_DEVID), 0);
 
-    AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, cert, certSz), 0);
+    AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, cert, certSz), 0);
 
     printf(testingFmt, "wc_PKCS7_VerifySignedData()");
 
-    pkcs7.content = data;
-    pkcs7.contentSz = (word32)sizeof(data);
-    pkcs7.privateKey = key;
-    pkcs7.privateKeySz = (word32)sizeof(key);
-    pkcs7.encryptOID = RSAk;
-    pkcs7.hashOID = SHAh;
-    pkcs7.rng = &rng;
+    pkcs7->content = data;
+    pkcs7->contentSz = (word32)sizeof(data);
+    pkcs7->privateKey = key;
+    pkcs7->privateKeySz = (word32)sizeof(key);
+    pkcs7->encryptOID = RSAk;
+    pkcs7->hashOID = SHAh;
+    pkcs7->rng = &rng;
 
-    AssertIntGT(wc_PKCS7_EncodeSignedData(&pkcs7, output, outputSz), 0);
-    wc_PKCS7_Free(&pkcs7);
-    AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, NULL, 0), 0);
-    AssertIntEQ(wc_PKCS7_VerifySignedData(&pkcs7, output, outputSz), 0);
+    AssertIntGT(wc_PKCS7_EncodeSignedData(pkcs7, output, outputSz), 0);
+    wc_PKCS7_Free(pkcs7);
+    AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
+    AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, NULL, 0), 0);
+    AssertIntEQ(wc_PKCS7_VerifySignedData(pkcs7, output, outputSz), 0);
 
     /* Test bad args. */
     AssertIntEQ(wc_PKCS7_VerifySignedData(NULL, output, outputSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_VerifySignedData(&pkcs7, NULL, outputSz), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_VerifySignedData(&pkcs7, badOut,
+    AssertIntEQ(wc_PKCS7_VerifySignedData(pkcs7, NULL, outputSz), BAD_FUNC_ARG);
+    AssertIntEQ(wc_PKCS7_VerifySignedData(pkcs7, badOut,
                                 badOutSz), BAD_FUNC_ARG);
 
     printf(resultFmt, passed);
 
-    wc_PKCS7_Free(&pkcs7);
+    wc_PKCS7_Free(pkcs7);
     wc_FreeRng(&rng);
 #endif
 } /* END test_wc_PKCS7_VerifySignedData() */
@@ -15478,7 +15487,7 @@ static void test_wc_PKCS7_VerifySignedData(void)
 static void test_wc_PKCS7_EncodeDecodeEnvelopedData (void)
 {
 #if defined(HAVE_PKCS7)
-    PKCS7       pkcs7;
+    PKCS7*      pkcs7;
     word32      tempWrd32   = 0;
     byte*       tmpBytePtr = NULL;
     const char  input[] = "Test data to encode.";
@@ -15642,42 +15651,44 @@ static void test_wc_PKCS7_EncodeDecodeEnvelopedData (void)
 
     printf(testingFmt, "wc_PKCS7_EncodeEnvelopedData()");
 
-    AssertIntEQ(wc_PKCS7_Init(&pkcs7, HEAP_HINT, devId), 0);
+    AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
+    AssertIntEQ(wc_PKCS7_Init(pkcs7, HEAP_HINT, devId), 0);
 
     testSz = (int)sizeof(testVectors)/(int)sizeof(pkcs7EnvelopedVector);
     for (i = 0; i < testSz; i++) {
-        AssertIntEQ(wc_PKCS7_InitWithCert(&pkcs7, (testVectors + i)->cert,
+        AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, (testVectors + i)->cert,
                                     (word32)(testVectors + i)->certSz), 0);
 
-        pkcs7.content       = (byte*)(testVectors + i)->content;
-        pkcs7.contentSz     = (testVectors + i)->contentSz;
-        pkcs7.contentOID    = (testVectors + i)->contentOID;
-        pkcs7.encryptOID    = (testVectors + i)->encryptOID;
-        pkcs7.keyWrapOID    = (testVectors + i)->keyWrapOID;
-        pkcs7.keyAgreeOID   = (testVectors + i)->keyAgreeOID;
-        pkcs7.privateKey    = (testVectors + i)->privateKey;
-        pkcs7.privateKeySz  = (testVectors + i)->privateKeySz;
+        pkcs7->content       = (byte*)(testVectors + i)->content;
+        pkcs7->contentSz     = (testVectors + i)->contentSz;
+        pkcs7->contentOID    = (testVectors + i)->contentOID;
+        pkcs7->encryptOID    = (testVectors + i)->encryptOID;
+        pkcs7->keyWrapOID    = (testVectors + i)->keyWrapOID;
+        pkcs7->keyAgreeOID   = (testVectors + i)->keyAgreeOID;
+        pkcs7->privateKey    = (testVectors + i)->privateKey;
+        pkcs7->privateKeySz  = (testVectors + i)->privateKeySz;
 
-        AssertIntGE(wc_PKCS7_EncodeEnvelopedData(&pkcs7, output,
+        AssertIntGE(wc_PKCS7_EncodeEnvelopedData(pkcs7, output,
                             (word32)sizeof(output)), 0);
 
-        decodedSz = wc_PKCS7_DecodeEnvelopedData(&pkcs7, output,
+        decodedSz = wc_PKCS7_DecodeEnvelopedData(pkcs7, output,
                 (word32)sizeof(output), decoded, (word32)sizeof(decoded));
         AssertIntGE(decodedSz, 0);
         /* Verify the size of each buffer. */
         AssertIntEQ((word32)sizeof(input)/sizeof(char), decodedSz);
         /* Don't free the last time through the loop. */
         if (i < testSz - 1 ){
-            wc_PKCS7_Free(&pkcs7);
+            wc_PKCS7_Free(pkcs7);
+            AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
         }
     }  /* END test loop. */
 
     /* Test bad args. */
     AssertIntEQ(wc_PKCS7_EncodeEnvelopedData(NULL, output,
                     (word32)sizeof(output)), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeEnvelopedData(&pkcs7, NULL,
+    AssertIntEQ(wc_PKCS7_EncodeEnvelopedData(pkcs7, NULL,
                     (word32)sizeof(output)), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_EncodeEnvelopedData(&pkcs7, output, 0), BAD_FUNC_ARG);
+    AssertIntEQ(wc_PKCS7_EncodeEnvelopedData(pkcs7, output, 0), BAD_FUNC_ARG);
     printf(resultFmt, passed);
 
     /* Decode.  */
@@ -15685,39 +15696,39 @@ static void test_wc_PKCS7_EncodeDecodeEnvelopedData (void)
 
     AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(NULL, output,
         (word32)sizeof(output), decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(&pkcs7, output,
+    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output,
         (word32)sizeof(output), NULL, (word32)sizeof(decoded)), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(&pkcs7, output,
+    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output,
         (word32)sizeof(output), decoded, 0), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(&pkcs7, NULL,
+    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, NULL,
         (word32)sizeof(output), decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG);
-    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(&pkcs7, output, 0, decoded,
+    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output, 0, decoded,
         (word32)sizeof(decoded)), BAD_FUNC_ARG);
     /* Should get a return of BAD_FUNC_ARG with structure data. Order matters.*/
-    tempWrd32 = pkcs7.singleCertSz;
-    pkcs7.singleCertSz = 0;
-    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(&pkcs7, output,
+    tempWrd32 = pkcs7->singleCertSz;
+    pkcs7->singleCertSz = 0;
+    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output,
         (word32)sizeof(output), decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG);
-    pkcs7.singleCertSz = tempWrd32;
-    tempWrd32 = pkcs7.privateKeySz;
-    pkcs7.privateKeySz = 0;
-    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(&pkcs7, output,
+    pkcs7->singleCertSz = tempWrd32;
+    tempWrd32 = pkcs7->privateKeySz;
+    pkcs7->privateKeySz = 0;
+    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output,
         (word32)sizeof(output), decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG);
-    pkcs7.privateKeySz = tempWrd32;
-    tmpBytePtr = pkcs7.singleCert;
-    pkcs7.singleCert = NULL;
-    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(&pkcs7, output,
+    pkcs7->privateKeySz = tempWrd32;
+    tmpBytePtr = pkcs7->singleCert;
+    pkcs7->singleCert = NULL;
+    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output,
         (word32)sizeof(output), decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG);
-    pkcs7.singleCert = tmpBytePtr;
-    tmpBytePtr = pkcs7.privateKey;
-    pkcs7.privateKey = NULL;
-    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(&pkcs7, output,
+    pkcs7->singleCert = tmpBytePtr;
+    tmpBytePtr = pkcs7->privateKey;
+    pkcs7->privateKey = NULL;
+    AssertIntEQ(wc_PKCS7_DecodeEnvelopedData(pkcs7, output,
         (word32)sizeof(output), decoded, (word32)sizeof(decoded)), BAD_FUNC_ARG);
-    pkcs7.privateKey = tmpBytePtr;
+    pkcs7->privateKey = tmpBytePtr;
 
     printf(resultFmt, passed);
 
-    wc_PKCS7_Free(&pkcs7);
+    wc_PKCS7_Free(pkcs7);
 #ifndef NO_RSA
     if (rsaCert) {
         XFREE(rsaCert, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index c02b3aba5..fa6a34d1f 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -8295,6 +8295,7 @@ int wc_PKCS7_DecodeEncryptedData(PKCS7* pkcs7, byte* in, word32 inSz,
             }
 #endif
             pkcs7->state = WC_PKCS7_STAGE2;
+            FALL_THROUGH
             /* end of stage 1 */
 
         case WC_PKCS7_STAGE2:
@@ -8335,6 +8336,7 @@ int wc_PKCS7_DecodeEncryptedData(PKCS7* pkcs7, byte* in, word32 inSz,
             }
 #endif
             pkcs7->state = WC_PKCS7_STAGE3;
+            FALL_THROUGH
             /* end of stage 2 */
 
        case WC_PKCS7_STAGE3:
@@ -8390,6 +8392,7 @@ int wc_PKCS7_DecodeEncryptedData(PKCS7* pkcs7, byte* in, word32 inSz,
             pkcs7->stream->vers = version;
 #endif
             pkcs7->state = WC_PKCS7_STAGE4;
+            FALL_THROUGH
             /* end of stage 3 */
 
         /* get block cipher IV, stored in OPTIONAL parameter of AlgoID */
@@ -8436,6 +8439,7 @@ int wc_PKCS7_DecodeEncryptedData(PKCS7* pkcs7, byte* in, word32 inSz,
             }
 #endif
             pkcs7->state = WC_PKCS7_STAGE5;
+            FALL_THROUGH
             /* end of stage 4 */
 
        case WC_PKCS7_STAGE5:
@@ -8490,6 +8494,7 @@ int wc_PKCS7_DecodeEncryptedData(PKCS7* pkcs7, byte* in, word32 inSz,
 
 #endif
             pkcs7->state = WC_PKCS7_STAGE6;
+            FALL_THROUGH
             /* end of stage 5 */
 
         case WC_PKCS7_STAGE6: