diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index 855019f8f..76e398b43 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -308,7 +308,7 @@ int wc_PKCS7_InitWithCert(PKCS7* pkcs7, byte* cert, word32 certSz)
         if (ret < 0) {
             FreeDecodedCert(dCert);
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(dCert, NULL, DYNAMIC_TYPE_DCERT);
+            XFREE(dCert, pkcs7->heap, DYNAMIC_TYPE_DCERT);
 #endif
             return ret;
         }
@@ -324,7 +324,7 @@ int wc_PKCS7_InitWithCert(PKCS7* pkcs7, byte* cert, word32 certSz)
         FreeDecodedCert(dCert);
 
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(dCert, NULL, DYNAMIC_TYPE_DCERT);
+        XFREE(dCert, pkcs7->heap, DYNAMIC_TYPE_DCERT);
 #endif
     }
 
@@ -613,7 +613,8 @@ static int wc_PKCS7_RsaSign(PKCS7* pkcs7, byte* in, word32 inSz, ESD* esd)
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    privKey = (RsaKey*)XMALLOC(sizeof(RsaKey), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    privKey = (RsaKey*)XMALLOC(sizeof(RsaKey), pkcs7->heap,
+        DYNAMIC_TYPE_TMP_BUFFER);
     if (privKey == NULL)
         return MEMORY_E;
 #endif
@@ -637,7 +638,7 @@ static int wc_PKCS7_RsaSign(PKCS7* pkcs7, byte* in, word32 inSz, ESD* esd)
 
     wc_FreeRsaKey(privKey);
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(privKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     return ret;
@@ -665,7 +666,8 @@ static int wc_PKCS7_EcdsaSign(PKCS7* pkcs7, byte* in, word32 inSz, ESD* esd)
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    privKey = (ecc_key*)XMALLOC(sizeof(ecc_key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    privKey = (ecc_key*)XMALLOC(sizeof(ecc_key), pkcs7->heap,
+        DYNAMIC_TYPE_TMP_BUFFER);
     if (privKey == NULL)
         return MEMORY_E;
 #endif
@@ -691,7 +693,7 @@ static int wc_PKCS7_EcdsaSign(PKCS7* pkcs7, byte* in, word32 inSz, ESD* esd)
 
     wc_ecc_free(privKey);
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(privKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     return ret;
@@ -960,7 +962,8 @@ static int wc_PKCS7_SignedDataBuildSignature(PKCS7* pkcs7,
         return BAD_FUNC_ARG;
 
 #ifdef WOLFSSL_SMALL_STACK
-    digestInfo = (byte*)XMALLOC(digestInfoSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    digestInfo = (byte*)XMALLOC(digestInfoSz, pkcs7->heap,
+        DYNAMIC_TYPE_TMP_BUFFER);
     if (digestInfo == NULL) {
         return MEMORY_E;
     }
@@ -971,7 +974,7 @@ static int wc_PKCS7_SignedDataBuildSignature(PKCS7* pkcs7,
                                    &digestInfoSz);
     if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -992,7 +995,7 @@ static int wc_PKCS7_SignedDataBuildSignature(PKCS7* pkcs7,
             hashSz = wc_HashGetDigestSize(esd->hashType);
             if (hashSz < 0) {
             #ifdef WOLFSSL_SMALL_STACK
-                XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
             #endif
                 return hashSz;
             }
@@ -1008,7 +1011,7 @@ static int wc_PKCS7_SignedDataBuildSignature(PKCS7* pkcs7,
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     if (ret >= 0) {
@@ -1062,7 +1065,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    esd = (ESD*)XMALLOC(sizeof(ESD), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    esd = (ESD*)XMALLOC(sizeof(ESD), pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (esd == NULL)
         return MEMORY_E;
 #endif
@@ -1073,7 +1076,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
     ret = wc_HashGetDigestSize(esd->hashType);
     if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(esd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(esd, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -1082,7 +1085,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
     ret = wc_HashInit(&esd->hash, esd->hashType);
     if (ret != 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(esd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(esd, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -1093,7 +1096,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
                             pkcs7->content, pkcs7->contentSz);
         if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(esd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(esd, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
         }
@@ -1103,7 +1106,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
                            &esd->contentDigest[2]);
         if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(esd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(esd, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
         }
@@ -1134,7 +1137,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
                                           &digEncAlgoType);
     if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(esd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(esd, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -1151,7 +1154,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
                                     messageDigestOid, sizeof(messageDigestOid));
         if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(esd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(esd, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return MEMORY_E;
         }
@@ -1161,7 +1164,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
         flatSignedAttribsSz = esd->signedAttribsSz;
         if (flatSignedAttribs == NULL) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(esd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(esd, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return MEMORY_E;
         }
@@ -1179,7 +1182,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
         if (pkcs7->signedAttribsSz != 0)
             XFREE(flatSignedAttribs, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(esd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(esd, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -1221,7 +1224,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
         if (pkcs7->signedAttribsSz != 0)
             XFREE(flatSignedAttribs, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(esd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(esd, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return BUFFER_E;
     }
@@ -1289,7 +1292,7 @@ int wc_PKCS7_EncodeSignedData(PKCS7* pkcs7, byte* output, word32 outputSz)
     idx += esd->encContentDigestSz;
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(esd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(esd, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     return idx;
@@ -1318,15 +1321,15 @@ static int wc_PKCS7_RsaVerify(PKCS7* pkcs7, byte* sig, int sigSz,
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    digest = (byte*)XMALLOC(MAX_PKCS7_DIGEST_SZ, NULL,
+    digest = (byte*)XMALLOC(MAX_PKCS7_DIGEST_SZ, pkcs7->heap,
                             DYNAMIC_TYPE_TMP_BUFFER);
 
     if (digest == NULL)
         return MEMORY_E;
 
-    key = (RsaKey*)XMALLOC(sizeof(RsaKey), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    key = (RsaKey*)XMALLOC(sizeof(RsaKey), pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (key == NULL) {
-        XFREE(digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(digest, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
         return MEMORY_E;
     }
 #endif
@@ -1336,8 +1339,8 @@ static int wc_PKCS7_RsaVerify(PKCS7* pkcs7, byte* sig, int sigSz,
     ret = wc_InitRsaKey_ex(key, pkcs7->heap, pkcs7->devId);
     if (ret != 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(key,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(digest, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(key,    pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -1347,8 +1350,8 @@ static int wc_PKCS7_RsaVerify(PKCS7* pkcs7, byte* sig, int sigSz,
         WOLFSSL_MSG("ASN RSA key decode error");
         wc_FreeRsaKey(key);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(key,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(digest, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(key,    pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return PUBLIC_KEY_E;
     }
@@ -1362,8 +1365,8 @@ static int wc_PKCS7_RsaVerify(PKCS7* pkcs7, byte* sig, int sigSz,
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    XFREE(key,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(digest, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key,    pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     return ret;
@@ -1394,15 +1397,15 @@ static int wc_PKCS7_EcdsaVerify(PKCS7* pkcs7, byte* sig, int sigSz,
         return BAD_FUNC_ARG;
 
 #ifdef WOLFSSL_SMALL_STACK
-    digest = (byte*)XMALLOC(MAX_PKCS7_DIGEST_SZ, NULL,
+    digest = (byte*)XMALLOC(MAX_PKCS7_DIGEST_SZ, pkcs7->heap,
                             DYNAMIC_TYPE_TMP_BUFFER);
 
     if (digest == NULL)
         return MEMORY_E;
 
-    key = (ecc_key*)XMALLOC(sizeof(ecc_key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    key = (ecc_key*)XMALLOC(sizeof(ecc_key), pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (key == NULL) {
-        XFREE(digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(digest, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
         return MEMORY_E;
     }
 #endif
@@ -1412,8 +1415,8 @@ static int wc_PKCS7_EcdsaVerify(PKCS7* pkcs7, byte* sig, int sigSz,
     ret = wc_ecc_init_ex(key, pkcs7->heap, pkcs7->devId);
     if (ret != 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(key,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(digest, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(key,    pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -1423,8 +1426,8 @@ static int wc_PKCS7_EcdsaVerify(PKCS7* pkcs7, byte* sig, int sigSz,
         WOLFSSL_MSG("ASN ECDSA key decode error");
         wc_ecc_free(key);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(key,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(digest, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(key,    pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return PUBLIC_KEY_E;
     }
@@ -1438,8 +1441,8 @@ static int wc_PKCS7_EcdsaVerify(PKCS7* pkcs7, byte* sig, int sigSz,
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    XFREE(key,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(digest, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key,    pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     return ret;
@@ -1488,7 +1491,8 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    digestInfo = (byte*)XMALLOC(MAX_PKCS7_DIGEST_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    digestInfo = (byte*)XMALLOC(MAX_PKCS7_DIGEST_SZ, pkcs7->heap,
+        DYNAMIC_TYPE_TMP_BUFFER);
     if (digestInfo == NULL)
         return MEMORY_E;
 #endif
@@ -1501,7 +1505,7 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
     ret = wc_HashGetDigestSize(hashType);
     if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -1511,7 +1515,7 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
     ret = wc_HashInit(&hash, hashType);
     if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -1520,7 +1524,7 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
 
         if (signedAttrib == NULL) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return BAD_FUNC_ARG;
         }
@@ -1529,7 +1533,7 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
         ret = wc_HashUpdate(&hash, hashType, attribSet, attribSetSz);
         if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return ret;
         }
@@ -1537,7 +1541,7 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
         ret = wc_HashUpdate(&hash, hashType, signedAttrib, signedAttribSz);
         if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return ret;
         }
@@ -1545,7 +1549,7 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
         ret = wc_HashFinal(&hash, hashType, digest);
         if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return ret;
         }
@@ -1554,7 +1558,7 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
 
         if (pkcs7->content == NULL) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return BAD_FUNC_ARG;
         }
@@ -1562,7 +1566,7 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
         ret = wc_HashUpdate(&hash, hashType, pkcs7->content, pkcs7->contentSz);
         if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return ret;
         }
@@ -1570,7 +1574,7 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
         ret = wc_HashFinal(&hash, hashType, digest);
         if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
             return ret;
         }
@@ -1600,7 +1604,7 @@ static int wc_PKCS7_BuildSignedDataDigest(PKCS7* pkcs7, byte* signedAttrib,
     *plainDigestSz = hashSz;
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(digestInfo, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(digestInfo, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
     return 0;
 }
@@ -1633,7 +1637,7 @@ static int wc_PKCS7_SignedDataVerifySignature(PKCS7* pkcs7, byte* sig,
         return BAD_FUNC_ARG;
 
 #ifdef WOLFSSL_SMALL_STACK
-    pkcs7Digest = (byte*)XMALLOC(MAX_PKCS7_DIGEST_SZ, NULL,
+    pkcs7Digest = (byte*)XMALLOC(MAX_PKCS7_DIGEST_SZ, pkcs7->heap,
                                  DYNAMIC_TYPE_TMP_BUFFER);
     if (pkcs7Digest == NULL)
         return MEMORY_E;
@@ -1647,7 +1651,7 @@ static int wc_PKCS7_SignedDataVerifySignature(PKCS7* pkcs7, byte* sig,
                                          &plainDigestSz);
     if (ret < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(pkcs7Digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pkcs7Digest, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -1679,7 +1683,7 @@ static int wc_PKCS7_SignedDataVerifySignature(PKCS7* pkcs7, byte* sig,
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-     XFREE(pkcs7Digest, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+     XFREE(pkcs7Digest, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
     return ret;
 }
@@ -2416,8 +2420,8 @@ static int wc_PKCS7_KariGenerateEphemeralKey(WC_PKCS7_KARI* kari, WC_RNG* rng)
         rng == NULL)
         return BAD_FUNC_ARG;
 
-    kari->senderKeyExport = (byte*)XMALLOC(kari->decoded->pubKeySize, kari->heap,
-                                           DYNAMIC_TYPE_PKCS7);
+    kari->senderKeyExport = (byte*)XMALLOC(kari->decoded->pubKeySize,
+                                           kari->heap, DYNAMIC_TYPE_PKCS7);
     if (kari->senderKeyExport == NULL)
         return MEMORY_E;
 
@@ -2927,15 +2931,15 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
     RsaKey* pubKey;
     DecodedCert* decoded;
 
-    serial = (byte*)XMALLOC(MAX_SN_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    keyAlgArray = (byte*)XMALLOC(MAX_SN_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), NULL,
+    serial = (byte*)XMALLOC(MAX_SN_SZ, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    keyAlgArray = (byte*)XMALLOC(MAX_SN_SZ, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    decoded = (DecodedCert*)XMALLOC(sizeof(DecodedCert), heap,
                                                        DYNAMIC_TYPE_TMP_BUFFER);
 
     if (decoded == NULL || serial == NULL || keyAlgArray == NULL) {
-        if (serial)      XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        if (keyAlgArray) XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        if (decoded)     XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        if (serial)      XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (keyAlgArray) XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (decoded)     XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
         return MEMORY_E;
     }
 
@@ -2954,9 +2958,9 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
     if (ret < 0) {
         FreeDecodedCert(decoded);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -2969,9 +2973,9 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
         WOLFSSL_MSG("DecodedCert lacks raw issuer pointer and length");
         FreeDecodedCert(decoded);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return -1;
     }
@@ -2982,9 +2986,9 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
         WOLFSSL_MSG("DecodedCert missing serial number");
         FreeDecodedCert(decoded);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return -1;
     }
@@ -2997,9 +3001,9 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
     if (keyEncAlgo != RSAk) {
         FreeDecodedCert(decoded);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ALGO_ID_E;
     }
@@ -3008,20 +3012,20 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
     if (keyEncAlgSz == 0) {
         FreeDecodedCert(decoded);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return BAD_FUNC_ARG;
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    pubKey = (RsaKey*)XMALLOC(sizeof(RsaKey), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    pubKey = (RsaKey*)XMALLOC(sizeof(RsaKey), heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (pubKey == NULL) {
         FreeDecodedCert(decoded);
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
         return MEMORY_E;
     }
 #endif
@@ -3031,10 +3035,10 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
     if (ret != 0) {
         FreeDecodedCert(decoded);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(pubKey,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pubKey,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -3045,10 +3049,10 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
         wc_FreeRsaKey(pubKey);
         FreeDecodedCert(decoded);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(pubKey,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pubKey,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return PUBLIC_KEY_E;
     }
@@ -3058,16 +3062,16 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
     wc_FreeRsaKey(pubKey);
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(pubKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(pubKey, heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     if (*keyEncSz < 0) {
         WOLFSSL_MSG("RSA Public Encrypt failed");
         FreeDecodedCert(decoded);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return *keyEncSz;
     }
@@ -3084,9 +3088,9 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
         WOLFSSL_MSG("RecipientInfo output buffer too small");
         FreeDecodedCert(decoded);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return BUFFER_E;
     }
@@ -3113,9 +3117,9 @@ static int wc_CreateRecipientInfo(const byte* cert, word32 certSz,
     FreeDecodedCert(decoded);
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    XFREE(keyAlgArray, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    XFREE(decoded,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(serial,      heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(keyAlgArray, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(decoded,     heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     return totalSz;
@@ -3436,12 +3440,13 @@ int wc_PKCS7_EncodeEnvelopedData(PKCS7* pkcs7, byte* output, word32 outputSz)
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    recip         = (byte*)XMALLOC(MAX_RECIP_SZ, NULL, DYNAMIC_TYPE_PKCS7);
-    contentKeyEnc = (byte*)XMALLOC(MAX_ENCRYPTED_KEY_SZ, NULL,
+    recip         = (byte*)XMALLOC(MAX_RECIP_SZ, pkcs7->heap,
+                                                       DYNAMIC_TYPE_PKCS7);
+    contentKeyEnc = (byte*)XMALLOC(MAX_ENCRYPTED_KEY_SZ, pkcs7->heap,
                                                        DYNAMIC_TYPE_PKCS7);
     if (contentKeyEnc == NULL || recip == NULL) {
-        if (recip)         XFREE(recip,         NULL, DYNAMIC_TYPE_PKCS7);
-        if (contentKeyEnc) XFREE(contentKeyEnc, NULL, DYNAMIC_TYPE_PKCS7);
+        if (recip)         XFREE(recip,         pkcs7->heap, DYNAMIC_TYPE_PKCS7);
+        if (contentKeyEnc) XFREE(contentKeyEnc, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         wc_FreeRng(&rng);
         return MEMORY_E;
     }
@@ -3480,14 +3485,14 @@ int wc_PKCS7_EncodeEnvelopedData(PKCS7* pkcs7, byte* output, word32 outputSz)
     ForceZero(contentKeyEnc, MAX_ENCRYPTED_KEY_SZ);
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(contentKeyEnc, NULL, DYNAMIC_TYPE_PKCS7);
+    XFREE(contentKeyEnc, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
 
     if (recipSz < 0) {
         WOLFSSL_MSG("Failed to create RecipientInfo");
         wc_FreeRng(&rng);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(recip, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(recip, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return recipSz;
     }
@@ -3498,7 +3503,7 @@ int wc_PKCS7_EncodeEnvelopedData(PKCS7* pkcs7, byte* output, word32 outputSz)
     wc_FreeRng(&rng);
     if (ret != 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(recip, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(recip, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -3507,7 +3512,7 @@ int wc_PKCS7_EncodeEnvelopedData(PKCS7* pkcs7, byte* output, word32 outputSz)
     contentTypeSz = wc_SetContentType(pkcs7->contentOID, contentType);
     if (contentTypeSz == 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(recip, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(recip, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return BAD_FUNC_ARG;
     }
@@ -3536,7 +3541,7 @@ int wc_PKCS7_EncodeEnvelopedData(PKCS7* pkcs7, byte* output, word32 outputSz)
     if (encryptedContent == NULL) {
         XFREE(plain, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(recip, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(recip, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return MEMORY_E;
     }
@@ -3553,7 +3558,7 @@ int wc_PKCS7_EncodeEnvelopedData(PKCS7* pkcs7, byte* output, word32 outputSz)
         XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         XFREE(plain, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(recip, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(recip, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return BAD_FUNC_ARG;
     }
@@ -3567,7 +3572,7 @@ int wc_PKCS7_EncodeEnvelopedData(PKCS7* pkcs7, byte* output, word32 outputSz)
         XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         XFREE(plain, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(recip, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(recip, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ret;
     }
@@ -3603,7 +3608,7 @@ int wc_PKCS7_EncodeEnvelopedData(PKCS7* pkcs7, byte* output, word32 outputSz)
         XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         XFREE(plain, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(recip, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(recip, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return BUFFER_E;
     }
@@ -3643,7 +3648,7 @@ int wc_PKCS7_EncodeEnvelopedData(PKCS7* pkcs7, byte* output, word32 outputSz)
     XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(recip, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(recip, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     return idx;
@@ -3692,15 +3697,15 @@ static int wc_PKCS7_DecodeKtri(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    serialNum = (mp_int*)XMALLOC(sizeof(mp_int), NULL,
-                                                   DYNAMIC_TYPE_TMP_BUFFER);
+    serialNum = (mp_int*)XMALLOC(sizeof(mp_int), pkcs7->heap,
+                                 DYNAMIC_TYPE_TMP_BUFFER);
     if (serialNum == NULL)
         return MEMORY_E;
 #endif
 
     if (GetInt(serialNum, pkiMsg, idx, pkiMsgSz) < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serialNum,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serialNum, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ASN_PARSE_E;
     }
@@ -3708,7 +3713,7 @@ static int wc_PKCS7_DecodeKtri(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     mp_clear(serialNum);
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(serialNum, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(serialNum, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     if (GetAlgoId(pkiMsg, idx, &encOID, oidKeyType, pkiMsgSz) < 0)
@@ -3720,7 +3725,7 @@ static int wc_PKCS7_DecodeKtri(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
 
     /* read encryptedKey */
 #ifdef WOLFSSL_SMALL_STACK
-    encryptedKey = (byte*)XMALLOC(MAX_ENCRYPTED_KEY_SZ, NULL,
+    encryptedKey = (byte*)XMALLOC(MAX_ENCRYPTED_KEY_SZ, pkcs7->heap,
                                   DYNAMIC_TYPE_TMP_BUFFER);
     if (encryptedKey == NULL)
         return MEMORY_E;
@@ -3728,14 +3733,14 @@ static int wc_PKCS7_DecodeKtri(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
 
     if (pkiMsg[(*idx)++] != ASN_OCTET_STRING) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(encryptedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ASN_PARSE_E;
     }
 
     if (GetLength(pkiMsg, idx, &encryptedKeySz, pkiMsgSz) < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(encryptedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ASN_PARSE_E;
     }
@@ -3746,18 +3751,19 @@ static int wc_PKCS7_DecodeKtri(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
 
     /* load private key */
 #ifdef WOLFSSL_SMALL_STACK
-    privKey = (RsaKey*)XMALLOC(sizeof(RsaKey), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    privKey = (RsaKey*)XMALLOC(sizeof(RsaKey), pkcs7->heap,
+        DYNAMIC_TYPE_TMP_BUFFER);
     if (privKey == NULL) {
-        XFREE(encryptedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
         return MEMORY_E;
     }
 #endif
 
-    ret = wc_InitRsaKey_ex(privKey, NULL, INVALID_DEVID);
+    ret = wc_InitRsaKey_ex(privKey, pkcs7->heap, INVALID_DEVID);
     if (ret != 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(encryptedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(privKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -3774,8 +3780,8 @@ static int wc_PKCS7_DecodeKtri(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
         WOLFSSL_MSG("Failed to decode RSA private key");
         wc_FreeRsaKey(privKey);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(encryptedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(privKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -3801,8 +3807,8 @@ static int wc_PKCS7_DecodeKtri(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     if (keySz <= 0 || outKey == NULL) {
         ForceZero(encryptedKey, MAX_ENCRYPTED_KEY_SZ);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(encryptedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(privKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return keySz;
     } else {
@@ -3812,8 +3818,8 @@ static int wc_PKCS7_DecodeKtri(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(encryptedKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(privKey, pkcs7->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     return 0;
@@ -4041,23 +4047,23 @@ static int wc_PKCS7_KariGetIssuerAndSerialNumber(WC_PKCS7_KARI* kari,
     }
 
 #ifdef WOLFSSL_SMALL_STACK
-    serial = (mp_int*)XMALLOC(sizeof(mp_int), NULL,
+    serial = (mp_int*)XMALLOC(sizeof(mp_int), kari->heap,
                               DYNAMIC_TYPE_TMP_BUFFER);
     if (serial == NULL)
         return MEMORY_E;
 
-    recipSerial = (mp_int*)XMALLOC(sizeof(mp_int), NULL,
+    recipSerial = (mp_int*)XMALLOC(sizeof(mp_int), kari->heap,
                                    DYNAMIC_TYPE_TMP_BUFFER);
     if (recipSerial == NULL) {
-        XFREE(serial, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial, kari->heap, DYNAMIC_TYPE_TMP_BUFFER);
         return MEMORY_E;
     }
 #endif
 
     if (GetInt(serial, pkiMsg, idx, pkiMsgSz) < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(recipSerial, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      kari->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(recipSerial, kari->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ASN_PARSE_E;
     }
@@ -4068,8 +4074,8 @@ static int wc_PKCS7_KariGetIssuerAndSerialNumber(WC_PKCS7_KARI* kari,
         mp_clear(serial);
         WOLFSSL_MSG("Failed to parse CMS recipient serial number");
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(recipSerial, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      kari->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(recipSerial, kari->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return ret;
     }
@@ -4079,8 +4085,8 @@ static int wc_PKCS7_KariGetIssuerAndSerialNumber(WC_PKCS7_KARI* kari,
         mp_clear(recipSerial);
         WOLFSSL_MSG("CMS serial number does not match recipient");
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(recipSerial, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(serial,      kari->heap, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(recipSerial, kari->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
         return PKCS7_RECIP_E;
     }
@@ -4089,8 +4095,8 @@ static int wc_PKCS7_KariGetIssuerAndSerialNumber(WC_PKCS7_KARI* kari,
     mp_clear(recipSerial);
 
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(serial,      NULL, DYNAMIC_TYPE_TMP_BUFFER);
-    XFREE(recipSerial, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(serial,      kari->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(recipSerial, kari->heap, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
 
     return 0;
@@ -4189,7 +4195,7 @@ static int wc_PKCS7_DecodeKari(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
         return MEMORY_E;
 
 #ifdef WOLFSSL_SMALL_STACK
-    encryptedKey = (byte*)XMALLOC(MAX_ENCRYPTED_KEY_SZ, NULL,
+    encryptedKey = (byte*)XMALLOC(MAX_ENCRYPTED_KEY_SZ, pkcs7->heap,
                                   DYNAMIC_TYPE_PKCS7);
     if (encryptedKey == NULL) {
         wc_PKCS7_KariFree(kari);
@@ -4205,7 +4211,7 @@ static int wc_PKCS7_DecodeKari(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     if (ret != 0) {
         wc_PKCS7_KariFree(kari);
         #ifdef WOLFSSL_SMALL_STACK
-            XFREE(encryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+            XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         #endif
         return ret;
     }
@@ -4216,7 +4222,7 @@ static int wc_PKCS7_DecodeKari(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     if (ret != 0) {
         wc_PKCS7_KariFree(kari);
         #ifdef WOLFSSL_SMALL_STACK
-            XFREE(encryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+            XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         #endif
         return ret;
     }
@@ -4226,7 +4232,7 @@ static int wc_PKCS7_DecodeKari(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     if (ret != 0) {
         wc_PKCS7_KariFree(kari);
         #ifdef WOLFSSL_SMALL_STACK
-            XFREE(encryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+            XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         #endif
         return ret;
     }
@@ -4238,7 +4244,7 @@ static int wc_PKCS7_DecodeKari(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     if (ret != 0) {
         wc_PKCS7_KariFree(kari);
         #ifdef WOLFSSL_SMALL_STACK
-            XFREE(encryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+            XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         #endif
         return ret;
     }
@@ -4265,7 +4271,7 @@ static int wc_PKCS7_DecodeKari(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
         default:
             wc_PKCS7_KariFree(kari);
             #ifdef WOLFSSL_SMALL_STACK
-                XFREE(encryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+                XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
             #endif
             WOLFSSL_MSG("AES key wrap algorithm unsupported");
             return BAD_KEYWRAP_ALG_E;
@@ -4277,7 +4283,7 @@ static int wc_PKCS7_DecodeKari(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     if (ret != 0) {
         wc_PKCS7_KariFree(kari);
         #ifdef WOLFSSL_SMALL_STACK
-            XFREE(encryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+            XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         #endif
         return ret;
     }
@@ -4287,7 +4293,7 @@ static int wc_PKCS7_DecodeKari(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     if (ret != 0) {
         wc_PKCS7_KariFree(kari);
         #ifdef WOLFSSL_SMALL_STACK
-            XFREE(encryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+            XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         #endif
         return ret;
     }
@@ -4299,7 +4305,7 @@ static int wc_PKCS7_DecodeKari(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
     if (keySz <= 0) {
         wc_PKCS7_KariFree(kari);
         #ifdef WOLFSSL_SMALL_STACK
-            XFREE(encryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+            XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
         #endif
         return keySz;
     }
@@ -4307,7 +4313,7 @@ static int wc_PKCS7_DecodeKari(PKCS7* pkcs7, byte* pkiMsg, word32 pkiMsgSz,
 
     wc_PKCS7_KariFree(kari);
     #ifdef WOLFSSL_SMALL_STACK
-        XFREE(encryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(encryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
     #endif
 
     return 0;
@@ -4504,7 +4510,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
         return ASN_PARSE_E;
 
 #ifdef WOLFSSL_SMALL_STACK
-    decryptedKey = (byte*)XMALLOC(MAX_ENCRYPTED_KEY_SZ, NULL,
+    decryptedKey = (byte*)XMALLOC(MAX_ENCRYPTED_KEY_SZ, pkcs7->heap,
                                                        DYNAMIC_TYPE_PKCS7);
     if (decryptedKey == NULL)
         return MEMORY_E;
@@ -4516,7 +4522,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
                                         &recipFound);
     if (ret != 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ret;
     }
@@ -4524,7 +4530,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
     if (recipFound == 0) {
         WOLFSSL_MSG("No recipient found in envelopedData that matches input");
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return PKCS7_RECIP_E;
     }
@@ -4532,21 +4538,21 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
     /* remove EncryptedContentInfo */
     if (GetSequence(pkiMsg, &idx, &length, pkiMsgSz) < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ASN_PARSE_E;
     }
 
     if (wc_GetContentType(pkiMsg, &idx, &contentType, pkiMsgSz) < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ASN_PARSE_E;
     }
 
     if (GetAlgoId(pkiMsg, &idx, &encOID, oidBlkType, pkiMsgSz) < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ASN_PARSE_E;
     }
@@ -4554,7 +4560,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
     blockKeySz = wc_PKCS7_GetOIDKeySize(encOID);
     if (blockKeySz < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return blockKeySz;
     }
@@ -4562,7 +4568,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
     expBlockSz = wc_PKCS7_GetOIDBlockSize(encOID);
     if (expBlockSz < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return expBlockSz;
     }
@@ -4570,14 +4576,14 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
     /* get block cipher IV, stored in OPTIONAL parameter of AlgoID */
     if (pkiMsg[idx++] != ASN_OCTET_STRING) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ASN_PARSE_E;
     }
 
     if (GetLength(pkiMsg, &idx, &length, pkiMsgSz) < 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ASN_PARSE_E;
     }
@@ -4585,7 +4591,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
     if (length != expBlockSz) {
         WOLFSSL_MSG("Incorrect IV length, must be of content alg block size");
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ASN_PARSE_E;
     }
@@ -4599,7 +4605,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
     if (pkiMsg[idx] != (ASN_CONTEXT_SPECIFIC | 0) &&
         pkiMsg[idx] != (ASN_CONTEXT_SPECIFIC | ASN_CONSTRUCTED | 0)) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ASN_PARSE_E;
     }
@@ -4607,7 +4613,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
 
     if (GetLength(pkiMsg, &idx, &encryptedContentSz, pkiMsgSz) <= 0) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ASN_PARSE_E;
     }
@@ -4615,14 +4621,14 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
     if (explicitOctet) {
         if (pkiMsg[idx++] != ASN_OCTET_STRING) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+            XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
             return ASN_PARSE_E;
         }
 
         if (GetLength(pkiMsg, &idx, &encryptedContentSz, pkiMsgSz) <= 0) {
 #ifdef WOLFSSL_SMALL_STACK
-            XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+            XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
             return ASN_PARSE_E;
         }
@@ -4632,7 +4638,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
                                                        DYNAMIC_TYPE_PKCS7);
     if (encryptedContent == NULL) {
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return MEMORY_E;
     }
@@ -4646,7 +4652,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
     if (ret != 0) {
         XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #ifdef WOLFSSL_SMALL_STACK
-        XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+        XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
         return ret;
     }
@@ -4661,7 +4667,7 @@ WOLFSSL_API int wc_PKCS7_DecodeEnvelopedData(PKCS7* pkcs7, byte* pkiMsg,
     ForceZero(encryptedContent, encryptedContentSz);
     XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #ifdef WOLFSSL_SMALL_STACK
-    XFREE(decryptedKey, NULL, DYNAMIC_TYPE_PKCS7);
+    XFREE(decryptedKey, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
 #endif
 
     return encryptedContentSz - padLen;