diff --git a/wolfcrypt/src/port/devcrypto/devcrypto_aes.c b/wolfcrypt/src/port/devcrypto/devcrypto_aes.c
index 95dac047cc..cccc6a7c24 100644
--- a/wolfcrypt/src/port/devcrypto/devcrypto_aes.c
+++ b/wolfcrypt/src/port/devcrypto/devcrypto_aes.c
@@ -253,13 +253,17 @@ int wc_AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     /* create key stream for later if needed */
     if (sz > 0) {
         Aes tmpAes;
-        if ((ret = wc_AesSetKey(&tmpAes, (byte*)aes->devKey, aes->keylen,
-                                (byte*)aes->reg, AES_ENCRYPTION)) != 0)
-            return ret;
-        if ((ret = wc_AesEncryptDirect(&tmpAes, (byte*)aes->tmp,
-                                       (const byte*)aes->reg)) != 0)
-            return ret;
+        ret = wc_AesSetKey(&tmpAes, (byte*)aes->devKey, aes->keylen,
+                           (byte*)aes->reg, AES_ENCRYPTION);
+        if (ret == 0) {
+            ret = wc_AesEncryptDirect(&tmpAes, (byte*)aes->tmp,
+                                      (const byte*)aes->reg);
+        }
         wc_AesFree(&tmpAes);
+        ForceZero(&tmpAes, sizeof(tmpAes));
+        if (ret != 0)
+            return ret;
+
         IncrementAesCounter((byte*)aes->reg);
 
         aes->left = WC_AES_BLOCK_SIZE - (sz % WC_AES_BLOCK_SIZE);