diff --git a/src/sniffer.c b/src/sniffer.c
index 7741c3f63..c25e43413 100644
--- a/src/sniffer.c
+++ b/src/sniffer.c
@@ -507,34 +507,15 @@ void ssl_InitSniffer(void)
 #endif
 #ifdef WOLF_CRYPTO_CB
     #ifdef HAVE_INTEL_QA_SYNC
-    {
-        int rc;
-        CryptoDeviceId = IntelQaInit(NULL);
-        if (CryptoDeviceId == INVALID_DEVID) {
-            printf("Couldn't init the Intel QA\n");
-        }
-        rc = IntelQaOpen(&CryptoDevice, CryptoDeviceId);
-        if (rc != 0) {
-            printf("Couldn't open the device\n");
-        }
-        rc = wc_CryptoCb_RegisterDevice(CryptoDeviceId,
-                IntelQaSymSync_CryptoDevCb, &CryptoDevice);
-        if (rc != 0) {
-            printf("Couldn't register the device\n");
-        }
+    CryptoDeviceId = wc_CryptoCb_InitIntelQa(&CryptoDevice);
+    if (INVALID_DEVID == CryptoDeviceId) {
+        printf("Couldn't init the Intel QA\n");
     }
     #endif
     #ifdef HAVE_CAVIUM_OCTEON_SYNC
-    {
-        CryptoDeviceId = wc_CryptoCb_GetDevIdOcteon();
-        if (CryptoDeviceId == INVALID_DEVID) {
-            printf("Couldn't get the Octeon device ID\n");
-        }
-        if (wc_CryptoCb_InitOcteon() != 0) {
-            printf("Couldn't init the Cavium Octeon\n");
-            CryptoDeviceId = INVALID_DEVID;
-        }
-    }
+    CryptoDeviceId = wc_CryptoCb_InitOcteon(NULL);
+    if (INVALID_DEVID == CryptoDeviceId) {
+        printf("Couldn't init the Intel QA\n");
     #endif
 #endif
 }
@@ -667,12 +648,10 @@ void ssl_FreeSniffer(void)
 
 #ifdef WOLF_CRYPTO_CB
 #ifdef HAVE_INTEL_QA_SYNC
-    wc_CryptoCb_UnRegisterDevice(CryptoDeviceId);
-    IntelQaClose(&CryptoDevice);
-    IntelQaDeInit(CryptoDeviceId);
+    wc_CryptoCb_CleanupIntelQa(&CryptoDeviceId, &CryptoDevice);
 #endif
 #ifdef HAVE_CAVIUM_OCTEON_SYNC
-    wc_CryptoCb_CleanupOcteon();
+    wc_CryptoCb_CleanupOcteon(&CryptoDeviceId, NULL);
 #endif
 #endif
 
diff --git a/wolfcrypt/benchmark/benchmark.c b/wolfcrypt/benchmark/benchmark.c
index 58a3f2391..cac7e7235 100755
--- a/wolfcrypt/benchmark/benchmark.c
+++ b/wolfcrypt/benchmark/benchmark.c
@@ -1304,33 +1304,15 @@ static void* benchmarks_do(void* args)
 
 #ifdef WOLF_CRYPTO_CB
 #ifdef HAVE_INTEL_QA_SYNC
-    {
-        int rc;
-        devId = IntelQaInit(NULL);
-        if (devId == INVALID_DEVID) {
-            printf("Couldn't init the Intel QA\n");
-        }
-        rc = IntelQaOpen(&devQat, devId);
-        if (rc != 0) {
-            printf("Couldn't open the device\n");
-        }
-        rc = wc_CryptoCb_RegisterDevice(devId,
-                IntelQaSymSync_CryptoDevCb, &devQat);
-        if (rc != 0) {
-            printf("Couldn't register the device\n");
-        }
+    devId = wc_CryptoCb_InitIntelQa(&devQat);
+    if (devId == INVALID_DEVID) {
+        printf("Couldn't init the Intel QA\n");
     }
 #endif
 #ifdef HAVE_CAVIUM_OCTEON_SYNC
-    {
-        devId = wc_CryptoCb_GetDevIdOcteon();
-        if (devId == INVALID_DEVID) {
-            printf("Couldn't get the Octeon device ID\n");
-        }
-        if (wc_CryptoCb_InitOcteon() != 0) {
-            printf("Couldn't init the Cavium Octeon\n");
-            devId = INVALID_DEVID;
-        }
+    devId = wc_CryptoCb_InitOcteon(NULL);
+    if (devId == INVALID_DEVID) {
+        printf("Couldn't get the Octeon device ID\n");
     }
 #endif
 #endif
@@ -1827,12 +1809,10 @@ exit:
 
 #ifdef WOLF_CRYPTO_CB
 #ifdef HAVE_INTEL_QA_SYNC
-    wc_CryptoCb_UnRegisterDevice(devId);
-    IntelQaClose(&devQat);
-    IntelQaDeInit(devId);
+    wc_CryptoCb_CleanupIntelQa(&devId, &devQat);
 #endif
 #ifdef HAVE_CAVIUM_OCTEON_SYNC
-    wc_CryptoCb_CleanupOcteon();
+    wc_CryptoCb_CleanupOcteon(&devId, NULL);
 #endif
 #endif
 
diff --git a/wolfcrypt/src/port/cavium/cavium_octeon_sync.c b/wolfcrypt/src/port/cavium/cavium_octeon_sync.c
index efe2ffdb3..a287f4345 100644
--- a/wolfcrypt/src/port/cavium/cavium_octeon_sync.c
+++ b/wolfcrypt/src/port/cavium/cavium_octeon_sync.c
@@ -646,8 +646,8 @@ static int Octeon_AesGcm_SetEncrypt(Aes* aes, byte* in, byte* out, word32 inSz,
             CVMX_MT_GFM_XORMUL1(pOut[1]);
         }
         else {
-            CVMX_MT_GFM_XOR0(pOut[0]);
-            CVMX_MT_GFM_XORMUL1(pOut[1]);
+            CVMX_MT_GFM_XOR0(pIn[0]);
+            CVMX_MT_GFM_XORMUL1(pIn[1]);
             pOut[0] ^= pIn[0];
             pOut[1] ^= pIn[1];
         }
@@ -657,9 +657,15 @@ static int Octeon_AesGcm_SetEncrypt(Aes* aes, byte* in, byte* out, word32 inSz,
     }
 
     if (remainder > 0) {
+        ALIGN16 byte aesBlockMask[AES_BLOCK_SIZE];
+        word64* pMask = (word64*)aesBlockMask;
+
         XMEMSET(aesBlockOut, 0, sizeof(aesBlockOut));
-        for (i = 0; i < remainder; i++)
+        XMEMSET(aesBlockMask, 0, sizeof(aesBlockMask));
+        for (i = 0; i < remainder; i++) {
             aesBlockIn[i] = in[i];
+            aesBlockMask[i] = 0xFF;
+        }
 
         if (encrypt) {
             CVMX_MF_AES_RESULT(pOut[0], 0);
@@ -668,6 +674,9 @@ static int Octeon_AesGcm_SetEncrypt(Aes* aes, byte* in, byte* out, word32 inSz,
             pOut[0] ^= pIn[0];
             pOut[1] ^= pIn[1];
 
+            pOut[0] &= pMask[0];
+            pOut[1] &= pMask[1];
+
             CVMX_MT_GFM_XOR0(pOut[0]);
             CVMX_MT_GFM_XORMUL1(pOut[1]);
         }
@@ -680,6 +689,9 @@ static int Octeon_AesGcm_SetEncrypt(Aes* aes, byte* in, byte* out, word32 inSz,
 
             pOut[0] ^= pIn[0];
             pOut[1] ^= pIn[1];
+
+            pOut[0] &= pMask[0];
+            pOut[1] &= pMask[1];
         }
 
         for (i = 0; i < remainder; i++)
@@ -881,21 +893,24 @@ static int myCryptoDevCb(int devIdArg, wc_CryptoInfo* info, void* ctx)
     return ret;
 }
 
-int wc_CryptoCb_InitOcteon(void)
+int wc_CryptoCb_InitOcteon(void* unused)
 {
-    return wc_CryptoCb_RegisterDevice(devId, myCryptoDevCb, NULL);
-}
+    (void)unused;
 
-void wc_CryptoCb_CleanupOcteon(void)
-{
-    wc_CryptoCb_UnRegisterDevice(devId);
-}
+    if (wc_CryptoCb_RegisterDevice(devId, myCryptoDevCb, NULL) < 0) {
+        return INVALID_DEVID;
+    }
 
-int wc_CryptoCb_GetDevIdOcteon(void)
-{
     return devId;
 }
 
+void wc_CryptoCb_CleanupOcteon(int* id, void* unused)
+{
+    (void)unused;
+    wc_CryptoCb_UnRegisterDevice(*id);
+    *id = INVALID_DEVID;
+}
+
 #endif /* WOLF_CRYPTO_CB */
 
 
diff --git a/wolfcrypt/src/port/intel/quickassist_sync.c b/wolfcrypt/src/port/intel/quickassist_sync.c
index c913b2870..1b4679996 100644
--- a/wolfcrypt/src/port/intel/quickassist_sync.c
+++ b/wolfcrypt/src/port/intel/quickassist_sync.c
@@ -1167,6 +1167,55 @@ int IntelQaSymSync_CryptoDevCb(int devId, struct wc_CryptoInfo* info, void* ctx)
     return rc;
 }
 
+/* -------------------------------------------------------------------------- */
+/* Public API                                                                 */
+/* -------------------------------------------------------------------------- */
+
+int wc_CryptoCb_InitIntelQa(void* dev)
+{
+    IntelQaDev* qaDev = (IntelQaDev*)dev;
+    int devId, rc;
+
+    devId = IntelQaInit(NULL);
+    if (devId < 0) {
+        QLOG("Couldn't init the Intel QA\n");
+        devId = INVALID_DEVID;
+    }
+    else {
+        rc = IntelQaOpen(qaDev, devId);
+        if (rc != 0) {
+            QLOG("Couldn't open the device\n");
+            IntelQaDeInit(devId);
+            devId = INVALID_DEVID;
+        }
+        else {
+            rc = wc_CryptoCb_RegisterDevice(devId,
+                    IntelQaSymSync_CryptoDevCb, qaDev);
+            if (rc != 0) {
+                QLOG("Couldn't register the device\n");
+                IntelQaClose(qaDev);
+                IntelQaDeInit(devId);
+                devId = INVALID_DEVID;
+            }
+        }
+    }
+
+    return devId;
+}
+
+
+void wc_CryptoCb_CleanupIntelQa(int* id, void* dev)
+{
+    IntelQaDev* qaDev = (IntelQaDev*)dev;
+
+    if (INVALID_DEVID != *id) {
+        wc_CryptoCb_UnRegisterDevice(*id);
+        IntelQaClose(qaDev);
+        IntelQaDeInit(*id);
+        *id = INVALID_DEVID;
+    }
+}
+
 #endif /* WOLF_CRYPTO_CB */
 
 
diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c
index 87f6538d9..8973eb909 100644
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -572,33 +572,15 @@ initDefaultName();
 
 #ifdef WOLF_CRYPTO_CB
 #ifdef HAVE_INTEL_QA_SYNC
-    {
-        int rc;
-        devId = IntelQaInit(NULL);
-        if (devId == INVALID_DEVID) {
-            printf("Couldn't init the Intel QA\n");
-        }
-        rc = IntelQaOpen(&devQat, devId);
-        if (rc != 0) {
-            printf("Couldn't open the device\n");
-        }
-        rc = wc_CryptoCb_RegisterDevice(devId,
-                IntelQaSymSync_CryptoDevCb, &devQat);
-        if (rc != 0) {
-            printf("Couldn't register the device\n");
-        }
+    devId = wc_CryptoCb_InitIntelQa(&devQat);
+    if (INVALID_DEVID == devId) {
+        printf("Couldn't init the Intel QA\n");
     }
 #endif
 #ifdef HAVE_CAVIUM_OCTEON_SYNC
-    {
-        devId = wc_CryptoCb_GetDevIdOcteon();
-        if (devId == INVALID_DEVID) {
-            printf("Couldn't get the Octeon device ID\n");
-        }
-        if (wc_CryptoCb_InitOcteon() != 0) {
-            printf("Couldn't init the Cavium Octeon\n");
-            devId = INVALID_DEVID;
-        }
+    devId = wc_CryptoCb_InitOcteon(NULL);
+    if (INVALID_DEVID == devId) {
+        printf("Couldn't init the Cavium Octeon\n");
     }
 #endif
 #endif
@@ -1168,12 +1150,10 @@ initDefaultName();
 
 #ifdef WOLF_CRYPTO_CB
 #ifdef HAVE_INTEL_QA_SYNC
-    wc_CryptoCb_UnRegisterDevice(devId);
-    IntelQaClose(&devQat);
-    IntelQaDeInit(devId);
+    wc_CryptoCb_CleanupIntelQa(&devId, &devQat);
 #endif
 #ifdef HAVE_CAVIUM_OCTEON_SYNC
-    wc_CryptoCb_CleanupOcteon();
+    wc_CryptoCb_CleanupOcteon(&devId, NULL);
 #endif
 #endif
 
diff --git a/wolfssl/wolfcrypt/port/cavium/cavium_octeon_sync.h b/wolfssl/wolfcrypt/port/cavium/cavium_octeon_sync.h
index 1ab8d8ef5..0da957ccb 100644
--- a/wolfssl/wolfcrypt/port/cavium/cavium_octeon_sync.h
+++ b/wolfssl/wolfcrypt/port/cavium/cavium_octeon_sync.h
@@ -42,34 +42,41 @@
 
 
 #ifdef WOLF_CRYPTO_CB
-int wc_CryptoCb_InitOcteon(void);
-void wc_CryptoCb_CleanupOcteon(void);
-int wc_CryptoCb_GetDevIdOcteon(void);
+WOLFSSL_API int wc_CryptoCb_InitOcteon(void* unused);
+WOLFSSL_API void wc_CryptoCb_CleanupOcteon(int* id, void* unused);
 #endif /* WOLF_CRYPTO_CB */
 
 
 #ifndef NO_DES3
-int Octeon_Des3_CbcEncrypt(Des3 *key, uint64_t *inp64, uint64_t *outp64, size_t inl);
-int Octeon_Des3_CbcDecrypt(Des3 *key, uint64_t *inp64, uint64_t *outp64, size_t inl);
+WOLFSSL_LOCAL int Octeon_Des3_CbcEncrypt(Des3 *key,
+        uint64_t *inp64, uint64_t *outp64, size_t inl);
+WOLFSSL_LOCAL int Octeon_Des3_CbcDecrypt(Des3 *key,
+        uint64_t *inp64, uint64_t *outp64, size_t inl);
 #endif /* !NO_DES3 */
 
 
 #ifndef NO_AES
 
 #ifdef WOLFSSL_AES_DIRECT
-int Octeon_AesEcb_Encrypt(Aes *aes, const unsigned char *in, unsigned char *out);
-int Octeon_AesEcb_Decrypt(Aes *aes, const unsigned char *in, unsigned char *out);
+WOLFSSL_LOCAL int Octeon_AesEcb_Encrypt(Aes *aes,
+        const unsigned char *in, unsigned char *out);
+WOLFSSL_LOCAL int Octeon_AesEcb_Decrypt(Aes *aes,
+        const unsigned char *in, unsigned char *out);
 #endif
 
 #ifdef HAVE_AES_CBC
-int Octeon_AesCbc_Encrypt(Aes *aes, uint64_t *inp64, uint64_t *outp64, size_t inl);
-int Octeon_AesCbc_Decrypt(Aes *aes, uint64_t *inp64, uint64_t *outp64, size_t inl);
+WOLFSSL_LOCAL int Octeon_AesCbc_Encrypt(Aes *aes,
+        uint64_t *inp64, uint64_t *outp64, size_t inl);
+WOLFSSL_LOCAL int Octeon_AesCbc_Decrypt(Aes *aes,
+        uint64_t *inp64, uint64_t *outp64, size_t inl);
 #endif
 
 #ifdef HAVE_AESGCM
-int Octeon_AesGcm_Encrypt(Aes* aes, byte* in, byte* out, word32 inSz,
+WOLFSSL_LOCAL int Octeon_AesGcm_Encrypt(Aes* aes,
+        byte* in, byte* out, word32 inSz,
         byte* iv, word32 ivSz, byte* aad, word32 aadSz, byte* tag);
-int Octeon_AesGcm_Decrypt(Aes* aes, byte* in, byte* out, word32 inSz,
+WOLFSSL_LOCAL int Octeon_AesGcm_Decrypt(Aes* aes,
+        byte* in, byte* out, word32 inSz,
         byte* iv, word32 ivSz, byte* aad, word32 aadSz, byte* tag);
 #endif /* HAVE_AESGCM */
 
diff --git a/wolfssl/wolfcrypt/port/intel/quickassist_sync.h b/wolfssl/wolfcrypt/port/intel/quickassist_sync.h
index 6a03ced37..ed591bb0d 100644
--- a/wolfssl/wolfcrypt/port/intel/quickassist_sync.h
+++ b/wolfssl/wolfcrypt/port/intel/quickassist_sync.h
@@ -154,17 +154,21 @@ typedef struct IntelQaDev {
 } IntelQaDev;
 
 
+WOLFSSL_API int wc_CryptoCb_InitIntelQa(void* dev);
+WOLFSSL_API void wc_CryptoCb_CleanupIntelQa(int* id, void* dev);
+
+
 /* Interface */
-WOLFSSL_API int IntelQaHardwareStart(const char*, int);
-WOLFSSL_API void IntelQaHardwareStop(void);
-WOLFSSL_API int IntelQaInit(void*);
-WOLFSSL_API void IntelQaDeInit(int);
-WOLFSSL_API int IntelQaNumInstances(void);
-WOLFSSL_API int IntelQaOpen(IntelQaDev*, int);
-WOLFSSL_API void IntelQaClose(IntelQaDev*);
-WOLFSSL_API int IntelQaDevCopy(IntelQaDev*, IntelQaDev*);
-WOLFSSL_API int IntelQaPoll(IntelQaDev*);
-WOLFSSL_API int IntelQaGetCyInstanceCount(void);
+WOLFSSL_LOCAL int IntelQaHardwareStart(const char*, int);
+WOLFSSL_LOCAL void IntelQaHardwareStop(void);
+WOLFSSL_LOCAL int IntelQaInit(void*);
+WOLFSSL_LOCAL void IntelQaDeInit(int);
+WOLFSSL_LOCAL int IntelQaNumInstances(void);
+WOLFSSL_LOCAL int IntelQaOpen(IntelQaDev*, int);
+WOLFSSL_LOCAL void IntelQaClose(IntelQaDev*);
+WOLFSSL_LOCAL int IntelQaDevCopy(IntelQaDev*, IntelQaDev*);
+WOLFSSL_LOCAL int IntelQaPoll(IntelQaDev*);
+WOLFSSL_LOCAL int IntelQaGetCyInstanceCount(void);
 
 #ifndef NO_AES
     #ifdef HAVE_AES_CBC
@@ -196,30 +200,30 @@ WOLFSSL_API int IntelQaGetCyInstanceCount(void);
 #endif /*! NO_DES3 */
 
 #ifdef WOLF_CRYPTO_CB
-    WOLFSSL_API int IntelQaSymSync_CryptoDevCb(int, struct wc_CryptoInfo*,
+    WOLFSSL_LOCAL int IntelQaSymSync_CryptoDevCb(int, struct wc_CryptoInfo*,
 			void*);
 #endif /* WOLF_CRYPTO_CB */
 
 
 #ifdef WOLFSSL_TRACK_MEMORY
-    WOLFSSL_API int InitMemoryTracker(void);
-    WOLFSSL_API void ShowMemoryTracker(void);
+    WOLFSSL_LOCAL int InitMemoryTracker(void);
+    WOLFSSL_LOCAL void ShowMemoryTracker(void);
 #endif
 
 
-WOLFSSL_API void* IntelQaMalloc(size_t size, void* heap, int type
+WOLFSSL_LOCAL void* IntelQaMalloc(size_t size, void* heap, int type
 #ifdef WOLFSSL_DEBUG_MEMORY
     , const char* func, unsigned int line
 #endif
 );
 
-WOLFSSL_API void IntelQaFree(void *ptr, void* heap, int type
+WOLFSSL_LOCAL void IntelQaFree(void *ptr, void* heap, int type
 #ifdef WOLFSSL_DEBUG_MEMORY
     , const char* func, unsigned int line
 #endif
 );
 
-WOLFSSL_API void* IntelQaRealloc(void *ptr, size_t size, void* heap, int type
+WOLFSSL_LOCAL void* IntelQaRealloc(void *ptr, size_t size, void* heap, int type
 #ifdef WOLFSSL_DEBUG_MEMORY
     , const char* func, unsigned int line
 #endif