diff --git a/Ubiquitous/XiZi_IIoT_Macro/kernel/memory/byte_manage.c b/Ubiquitous/XiZi_IIoT_Macro/kernel/memory/byte_manage.c
index 80ce5e7cd..9e5ea78c1 100644
--- a/Ubiquitous/XiZi_IIoT_Macro/kernel/memory/byte_manage.c
+++ b/Ubiquitous/XiZi_IIoT_Macro/kernel/memory/byte_manage.c
@@ -881,6 +881,11 @@ void ExtSramInitBoardMemory(void* start_phy_address, void* end_phy_address, uint
     NULL_PARAM_CHECK(start_phy_address);
     NULL_PARAM_CHECK(end_phy_address);
 
+    if (extsram_idx >= EXTSRAM_MAX_NUM) {
+        KPrintf("ExtSramInitBoardMemory, invalid extsram_idx %u\n", extsram_idx);
+        return;
+    }
+
     KDEBUG_NOT_IN_INTERRUPT;
     struct DynamicBuddyMemory* uheap = &ExtByteManager[extsram_idx].dynamic_buddy_manager;
 
diff --git a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/assign.c b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/assign.c
index d2071eb1d..c024a290b 100644
--- a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/assign.c
+++ b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/assign.c
@@ -379,8 +379,13 @@ void StartupOsAssign(void)
  *
  * system OsAssign init function
  */
+extern void __init_ssp(void *);
+
 void SysInitOsAssign(void)
 {
+    /* Initialize SSP canary before tasks run; NULL uses address-based fallback */
+    __init_ssp(NONE);
+
     SYS_KDEBUG_LOG(KDBG_SCHED, ("start Os Assign: max priority 0x%02x\n",
                                       KTASK_PRIORITY_MAX));
 
diff --git a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/avl_tree.c b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/avl_tree.c
index 76d340e68..f39e79ed1 100644
--- a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/avl_tree.c
+++ b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/avl_tree.c
@@ -157,35 +157,33 @@ static AvlNodeType AvlTreeSetRLRotate(AvlNodeType avl_node)
  */
 static AvlNodeType AvlTreeBalance(AvlNodeType avl_node)
 {
-    if(avl_node)
-    {
-        AvlNodeType new_node = NONE;
-        uint32 avlnode_BF = AVL_ABS(AvlTreeGetNodeBalanceFactor(avl_node));
+    int32 bf = 0;
+    int32 child_bf = 0;
 
-        if(avlnode_BF > 1) {
-            if(AvlTreeGetNodeBalanceFactor(avl_node->left) > 0) {
-                /*LL case*/
-                new_node = AvlTreeSetRightRotate(avl_node);
-            } else if(AvlTreeGetNodeBalanceFactor(avl_node->left) < 0) {
-                /*LR case*/
-                new_node = AvlTreeSetLRRotate(avl_node);
-            } else if(AvlTreeGetNodeBalanceFactor(avl_node->right) < 0) {
-                /*RR case*/
-                new_node = AvlTreeSetLeftRotate(avl_node);
-            } else if(AvlTreeGetNodeBalanceFactor(avl_node->right) > 0) {
-                /*RL case*/
-                new_node = AvlTreeSetRLRotate(avl_node);
-            }
-        } else {
-            /*the avl tree is balanced, no need to rebalance*/
-            new_node = avl_node;
-        }
-
-        return new_node;
-
-    } else {
+    if (avl_node == NONE)
         return NONE;
+
+    bf = AvlTreeGetNodeBalanceFactor(avl_node);
+
+    if (bf > 1) {
+        /* Left-heavy: LL (incl. left BF == 0 after delete) or LR */
+        child_bf = AvlTreeGetNodeBalanceFactor(avl_node->left);
+        if (child_bf >= 0)
+            return AvlTreeSetRightRotate(avl_node);
+        else
+            return AvlTreeSetLRRotate(avl_node);
     }
+
+    if (bf < -1) {
+        /* Right-heavy: RR (incl. right BF == 0 after delete) or RL */
+        child_bf = AvlTreeGetNodeBalanceFactor(avl_node->right);
+        if (child_bf <= 0)
+            return AvlTreeSetLeftRotate(avl_node);
+        else
+            return AvlTreeSetRLRotate(avl_node);
+    }
+
+    return avl_node;
 }
 
 /**
@@ -202,7 +200,6 @@ AvlNodeType AvlTreeInsertNode(AvlNodeType avl_node, int32 data)
         new_node = x_malloc(sizeof(struct AvlNode));
         if(NONE == new_node) {
             KPrintf("AvlTreeInsertNode malloc AvlNode failed\n");
-            x_free(new_node);
             return NONE;
         }
         new_node->data = data;
diff --git a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/circular_area.c b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/circular_area.c
index 92809e54b..0ae4563e4 100644
--- a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/circular_area.c
+++ b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/circular_area.c
@@ -253,7 +253,6 @@ CircularAreaType CircularAreaInit(uint32 circular_area_length)
     CircularAreaType circular_area = x_malloc(sizeof(struct CircularArea));
     if(NONE == circular_area) {
         KPrintf("CircularAreaInit malloc struct circular_area failed\n");
-        x_free(circular_area);
         return NONE;
     }
 
@@ -262,7 +261,7 @@ CircularAreaType CircularAreaInit(uint32 circular_area_length)
     circular_area->data_buffer = x_malloc(circular_area_length);
     if(NONE == circular_area->data_buffer) {
         KPrintf("CircularAreaInit malloc circular_area data_buffer failed\n");
-        x_free(circular_area->data_buffer);
+        x_free(circular_area);
         return NONE;
     }
 
diff --git a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/id.c b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/id.c
index 1ad7dd59d..29fcdeff0 100644
--- a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/id.c
+++ b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/id.c
@@ -95,7 +95,7 @@ static struct IdNode *GetObj(struct IdManager *manager, uint16 id)
     return idnode;
 }
 
-static struct IdNode *RemoveObj(struct IdManager *manager, struct IdNode *idnode)
+static void RemoveObj(struct IdManager *manager, struct IdNode *idnode)
 {
     NULL_PARAM_CHECK(manager);
     NULL_PARAM_CHECK(idnode);
diff --git a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/msgqueue.c b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/msgqueue.c
index e4f9a63dd..c654d8db9 100644
--- a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/msgqueue.c
+++ b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/msgqueue.c
@@ -107,15 +107,11 @@ static x_err_t _MsgQueueSend(struct MsgQueue* mq,
         timeout = CalculateTickFromTimeMs(msec);
 
     lock = CriticalAreaLock();
-    if (mq->num_msgs >= mq->max_msgs && timeout == 0) {
-        CriticalAreaUnLock(lock);
-        return -EFULL;
-    }
-
     while (mq->num_msgs >= mq->max_msgs) {
         task->exstatus = EOK;
         if (timeout == 0) {
             CriticalAreaUnLock(lock);
+            task->exstatus = -EFULL;
             return -EFULL;
         }
         KDEBUG_IN_KTASK_CONTEXT;
@@ -214,11 +210,6 @@ static x_err_t _MsgQueueRecv(struct MsgQueue* mq,
     timeout = CalculateTickFromTimeMs(msec);
 
     lock = CriticalAreaLock();
-    if (timeout == 0 && mq->num_msgs <= 0) {
-        CriticalAreaUnLock(lock);
-        return -ETIMEOUT;
-    }
-
     while (mq->num_msgs <= 0) {
         KDEBUG_IN_KTASK_CONTEXT;
 
diff --git a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/semaphore.c b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/semaphore.c
index 8a461aa88..11aec38a7 100644
--- a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/semaphore.c
+++ b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/semaphore.c
@@ -177,6 +177,10 @@ static int32 _SemaphoreAbandon(int32 id)
         resched = 1;
         LinklistResume(&sem->pend_list);
     } else {
+        if (sem->value == UINT16_MAX) {
+            CriticalAreaUnLock(lock);
+            return -EFULL;
+        }
         sem->value++;
     }
 
diff --git a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/smp_assign.c b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/smp_assign.c
index d9f19419e..4ec7062a8 100644
--- a/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/smp_assign.c
+++ b/Ubiquitous/XiZi_IIoT_Macro/kernel/thread/smp_assign.c
@@ -474,8 +474,13 @@ void StartupOsAssign(void)
  *
  * system OsAssign init function
  */
+extern void __init_ssp(void *);
+
 void SysInitOsAssign(void)
 {
+    /* Initialize SSP canary before tasks run; NULL uses address-based fallback */
+    __init_ssp(NONE);
+
     SYS_KDEBUG_LOG(KDBG_SCHED, ("start Os Assign: max priority 0x%02x\n",
                                       KTASK_PRIORITY_MAX));