diff --git a/core/mac/src/pe/lim/lim_process_action_frame.c b/core/mac/src/pe/lim/lim_process_action_frame.c
index e2f13bb66709..d1ba40d169ad 100644
--- a/core/mac/src/pe/lim/lim_process_action_frame.c
+++ b/core/mac/src/pe/lim/lim_process_action_frame.c
@@ -1345,7 +1345,7 @@ __lim_process_radio_measure_request(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 				    tpPESession psessionEntry)
 {
 	tpSirMacMgmtHdr pHdr;
-	tDot11fRadioMeasurementRequest frm;
+	tDot11fRadioMeasurementRequest *frm;
 	uint32_t frameLen, nStatus;
 	uint8_t *pBody;
 
@@ -1361,31 +1361,38 @@ __lim_process_radio_measure_request(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
 		frameLen + sizeof(tSirMacMgmtHdr), 0,
 		WMA_GET_RX_CH(pRxPacketInfo), psessionEntry, 0);
 
+	frm = qdf_mem_malloc(sizeof(*frm));
+	if (frm == NULL) {
+		lim_log(pMac, LOGE,
+			FL("Failed to alloc memory for tDot11fRadioMeasurementRequest"));
+		return;
+	}
+
 	/**Unpack the received frame */
-	nStatus =
-		dot11f_unpack_radio_measurement_request(pMac, pBody, frameLen, &frm);
+	nStatus = dot11f_unpack_radio_measurement_request(pMac,
+								pBody,
+								frameLen, frm);
 
 	if (DOT11F_FAILED(nStatus)) {
 		lim_log(pMac, LOGE,
-			FL
-				("Failed to unpack and parse a Radio Measure request (0x%08x, %d bytes):"),
+			FL("Failed to unpack and parse a Radio Measure request (0x%08x, %d bytes):"),
 			nStatus, frameLen);
 		PELOG2(sir_dump_buf
-			       (pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen);
-		       )
-		return;
+		       (pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen);)
+		    goto err;
 	} else if (DOT11F_WARNED(nStatus)) {
 		lim_log(pMac, LOGW,
-			FL
-				("There were warnings while unpacking a Radio Measure request (0x%08x, %d bytes):"),
+			FL("There were warnings while unpacking a Radio Measure request (0x%08x, %d bytes):"),
 			nStatus, frameLen);
 		PELOG2(sir_dump_buf
-			       (pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen);
-		       )
+		       (pMac, SIR_DBG_MODULE_ID, LOG2, pBody, frameLen);)
 	}
 	/* Call rrm function to handle the request. */
 
-	rrm_process_radio_measurement_request(pMac, pHdr->sa, &frm, psessionEntry);
+	rrm_process_radio_measurement_request(pMac, pHdr->sa, frm,
+					      psessionEntry);
+err:
+	qdf_mem_free(frm);
 }
 
 static void
diff --git a/core/sap/src/sap_ch_select.c b/core/sap/src/sap_ch_select.c
index a00c48db3a03..ceadb0bb37d8 100644
--- a/core/sap/src/sap_ch_select.c
+++ b/core/sap/src/sap_ch_select.c
@@ -1897,9 +1897,9 @@ bool sap_filter_over_lap_ch(ptSapContext pSapCtx, uint16_t chNum)
  */
 static uint8_t sap_select_channel_no_scan_result(ptSapContext sap_ctx)
 {
-	enum channel_state ch_type;
 	uint32_t start_ch_num, end_ch_num;
 #ifdef FEATURE_WLAN_CH_AVOID
+	enum channel_state ch_type;
 	uint8_t i, first_safe_ch_in_range = SAP_CHANNEL_NOT_SELECTED;
 #endif
 	start_ch_num = sap_ctx->acs_cfg->start_ch;