diff --git a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c
index 6bb9de6cc15..c2e2773792c 100644
--- a/components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c
+++ b/components/bt/host/bluedroid/bta/hf_ag/bta_ag_act.c
@@ -397,10 +397,6 @@ void bta_ag_rfc_close(tBTA_AG_SCB *p_scb, tBTA_AG_DATA *p_data)
 
     bta_sys_conn_close(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr);
 
-    /* call close call-out */
-#if (BTM_SCO_HCI_INCLUDED == TRUE)
-    bta_ag_sco_co_close();
-#endif
     /* call close cback */
     (*bta_ag_cb.p_cback)(BTA_AG_CLOSE_EVT, (tBTA_AG *) &close);
 
diff --git a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c
index 104182412a3..6149d8c4189 100644
--- a/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c
+++ b/components/bt/host/bluedroid/bta/hf_client/bta_hf_client_api.c
@@ -61,7 +61,8 @@ static const uint8_t bta_hf_client_cb_data_size[] = {
     sizeof(tBTA_HF_CLIENT_VAL),         // #define BTA_HF_CLIENT_BSIR_EVT              19
     sizeof(tBTA_HF_CLIENT_NUMBER),      // #define BTA_HF_CLIENT_BINP_EVT              20
     sizeof(tBTA_HF_CLIENT_VAL),         // #define BTA_HF_CLIENT_RING_INDICATION       21
-    0,                                  // #define BTA_HF_CLIENT_DISABLE_EVT           30
+    0,                                  // #define BTA_HF_CLIENT_DISABLE_EVT           22
+    sizeof(tBTA_SCO_PKT_STAT_NUMS),     // #define BTA_HF_CLIENT_PKT_STAT_NUMS_GET_EVT      23
 };
 /*****************************************************************************
 **  External Function Declarations
diff --git a/components/bt/host/bluedroid/bta/include/bta/bta_hf_client_api.h b/components/bt/host/bluedroid/bta/include/bta/bta_hf_client_api.h
index 30ca233b69f..ac834c7b6f7 100644
--- a/components/bt/host/bluedroid/bta/include/bta/bta_hf_client_api.h
+++ b/components/bt/host/bluedroid/bta/include/bta/bta_hf_client_api.h
@@ -112,8 +112,8 @@ typedef UINT8 tBTA_HF_CLIENT_AT_RESULT_TYPE;
 #define BTA_HF_CLIENT_BSIR_EVT              19 /* in-band ring tone setting changed event */
 #define BTA_HF_CLIENT_BINP_EVT              20 /* binp number event */
 #define BTA_HF_CLIENT_RING_INDICATION       21 /* HF Client ring indication */
-#define BTA_HF_CLIENT_DISABLE_EVT           30 /* HF Client disabled */
-#define BTA_HF_CLIENT_PKT_STAT_NUMS_GET_EVT 31 /* HF Client packet status nums */
+#define BTA_HF_CLIENT_DISABLE_EVT           22 /* HF Client disabled */
+#define BTA_HF_CLIENT_PKT_STAT_NUMS_GET_EVT 23 /* HF Client packet status nums */
 
 typedef UINT8 tBTA_HF_CLIENT_EVT;
 
diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c b/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c
index 84d006647a8..6000f8324c2 100644
--- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c
+++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/bta_ag_co.c
@@ -82,7 +82,7 @@ static bta_ag_co_cb_t *bta_ag_co_cb_ptr;
 #define bta_ag_co_cb (*bta_ag_co_cb_ptr)
 #endif /* HFP_DYNAMIC_MEMORY == FALSE */
 
-static UINT8 hf_air_mode = BTM_SCO_AIR_MODE_TRANSPNT;
+static UINT8 hf_air_mode = BTM_SCO_AIR_MODE_UNKNOWN;
 static UINT8 hf_inout_pkt_size = 0;
 
 /* =========================================================================
diff --git a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
index d04ec79f5c1..129d1b17893 100644
--- a/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
+++ b/components/bt/host/bluedroid/btc/profile/std/hf_ag/btc_hf_ag.c
@@ -68,7 +68,7 @@ static UINT16 btc_max_hf_clients = BTC_HF_NUM_CB;
 #if HFP_DYNAMIC_MEMORY == FALSE
 static hf_local_param_t hf_local_param[BTC_HF_NUM_CB];
 #else
-static hf_local_param_t *hf_local_param;
+static hf_local_param_t *hf_local_param = NULL;
 #endif
 
 #if (BTM_WBS_INCLUDED == TRUE)
@@ -317,6 +317,19 @@ bt_status_t btc_hf_init(void)
     int idx = 0;
 
     BTC_TRACE_DEBUG("%s - max_hf_clients=%d", __func__, btc_max_hf_clients);
+
+#if HFP_DYNAMIC_MEMORY == TRUE
+    if (hf_local_param != NULL) {
+        return BT_STATUS_FAIL;
+    }
+
+    if ((hf_local_param = (hf_local_param_t *)osi_malloc(BTC_HF_NUM_CB * sizeof(hf_local_param_t))) == NULL) {
+        APPL_TRACE_ERROR("%s malloc failed!", __func__);
+        return BT_STATUS_NOMEM;
+    }
+    memset((void *)hf_local_param, 0, BTC_HF_NUM_CB * sizeof(hf_local_param_t));
+#endif
+
     /* Invoke the enable service API to the core to set the appropriate service_id
      * Internally, the HSP_SERVICE_ID shall also be enabled if HFP is enabled (phone)
      * othwerwise only HSP is enabled (tablet)*/
@@ -345,13 +358,16 @@ void btc_hf_deinit(void)
 {
     BTC_TRACE_EVENT("%s", __FUNCTION__);
     btc_dm_disable_service(BTA_HFP_SERVICE_ID);
+    hf_local_param[0].btc_hf_cb.initialized = false;
+}
+
+static void btc_hf_cb_release(void)
+{
 #if HFP_DYNAMIC_MEMORY == TRUE
     if (hf_local_param) {
         osi_free(hf_local_param);
         hf_local_param = NULL;
     }
-#else
-    hf_local_param[0].btc_hf_cb.initialized = false;
 #endif
 }
 
@@ -1251,9 +1267,12 @@ void btc_hf_cb_handler(btc_msg_t *msg)
 
     switch (event) {
         case BTA_AG_ENABLE_EVT:
+            break;
         case BTA_AG_DISABLE_EVT:
+        {
+            btc_hf_cb_release();
             break;
-
+        }
         case BTA_AG_REGISTER_EVT:
         {
             idx = p_data->hdr.handle - 1;
diff --git a/components/bt/host/bluedroid/common/include/common/bt_target.h b/components/bt/host/bluedroid/common/include/common/bt_target.h
index cb87f02f22e..f467d11200f 100644
--- a/components/bt/host/bluedroid/common/include/common/bt_target.h
+++ b/components/bt/host/bluedroid/common/include/common/bt_target.h
@@ -1018,7 +1018,7 @@
 /* TRUE to include Sniff Subrating */
 #if (BTA_DM_PM_INCLUDED == TRUE)
 #ifndef BTM_SSR_INCLUDED
-#define BTM_SSR_INCLUDED                TRUE
+#define BTM_SSR_INCLUDED                FALSE
 #endif
 #endif /* BTA_DM_PM_INCLUDED */