diff --git a/src/core/agent.c b/src/core/agent.c
index 138f2b8cca41eb9268649d7fbf4af976cb3f4d0f..936b33c98d92d2f8613a7fcdbad94d107ab71c62 100644
--- a/src/core/agent.c
+++ b/src/core/agent.c
@@ -3906,11 +3906,36 @@ int agent_msgqueue_dispatcher(void *data)
 	return ret;
 }
 
+/* TODO:re-visit */
+void clear_stalist(struct netif_fh *p)
+{
+	struct sta *s, *tmp;
+
+	list_for_each_entry_safe(s, tmp, &p->stalist, list) {
+		dbg("Delete STA " MACFMT "\n", MAC2STR(s->macaddr));
+		uloop_timeout_cancel(&s->sta_finalize_timer);
+		uloop_timeout_cancel(&s->sta_steer_timer);
+		uloop_timeout_cancel(&s->sta_nbr_timer);
+		uloop_timeout_cancel(&s->sta_timer);
+		list_del(&s->list);
+		free(s);
+	}
+}
+
 void clear_fhlist(struct agent *a)
 {
 	struct netif_fh *p, *tmp;
 
 	list_for_each_entry_safe(p, tmp,  &a->fhlist, list) {
+		/* clear stalist */
+		clear_stalist(p);
+
+		/* TODO/revisit */
+		if (p->util_threshold_timer.cb)
+			uloop_timeout_cancel(&p->util_threshold_timer);
+		if (p->rcpi_threshold_timer.cb)
+			uloop_timeout_cancel(&p->rcpi_threshold_timer);
+
 		list_del(&p->list);
 		free(p);
 	}
diff --git a/src/core/agent_cmdu_generator.c b/src/core/agent_cmdu_generator.c
index cad7d8eedd34c5de228b7d4500b5132df9171c92..509e48aa737ae490a4122dd46e96652dc8f43f0b 100644
--- a/src/core/agent_cmdu_generator.c
+++ b/src/core/agent_cmdu_generator.c
@@ -102,9 +102,8 @@ struct cmdu_cstruct *agent_gen_ap_autoconfig_search(struct agent *a,
 	if (!p1->service)
 		goto fail_p1;
 
-	for (i = 0; i < p->supported_services_list; i++)
-		p->supported_services[i].service =
-				SEARCHED_SERVICE_MULTIAP_CONTROLLER;
+	for (i = 0; i < p1->searched_services_list; i++)
+		p1->service[i] = SEARCHED_SERVICE_MULTIAP_CONTROLLER;
 
 	p2 = calloc(1, sizeof(struct tlv_map_profile));
 	if (!p2)
@@ -432,7 +431,14 @@ struct cmdu_cstruct *agent_gen_assoc_sta_metric_response_per_intf(
 // #endif
 	}
 
-	cmdu->tlvs = (uint8_t **)calloc(cmdu->num_tlvs, sizeof(uint8_t *));
+	if (cmdu->num_tlvs > 0)
+		cmdu->tlvs = (uint8_t **)calloc(cmdu->num_tlvs, sizeof(uint8_t *));
+	else {
+		/* no sta is for this radio interface
+		 * free the cmdu */
+		goto error;
+	}
+
 	if (!cmdu->tlvs) {
 		cmdu->num_tlvs = 0;
 		goto error;
@@ -827,4 +833,4 @@ struct cmdu_cstruct *agent_gen_client_disassoc(struct agent *a,
 error:
 	map_free_cmdu(cmdu_data);
 	return NULL;
-}
\ No newline at end of file
+}
diff --git a/src/core/agent_map.c b/src/core/agent_map.c
index 4f26dbfb539de406f965d4b1b84f669f070defd7..06bab764aa81aa60427fe36b173af6173aa2bc81 100644
--- a/src/core/agent_map.c
+++ b/src/core/agent_map.c
@@ -1485,6 +1485,13 @@ static int agent_process_policy_config(struct agent *a)
 	struct agent_config *cfg = &a->cfg;
 	struct policy_cfg *c = cfg->pcfg;
 
+	/* timer cleanup */
+	if (cfg->metric_report_timer.cb) {
+		uloop_timeout_cancel(&cfg->metric_report_timer);
+		cfg->metric_report_timer.cb = NULL;
+	}
+
+
 	if (c && (c->report_interval > 0)) {
 		cfg->metric_report_timer.cb = agent_metric_report_timer_cb;
 		uloop_timeout_set(&cfg->metric_report_timer,
@@ -1498,6 +1505,17 @@ static int agent_process_policy_config(struct agent *a)
 		if (!p)
 			continue;
 
+		/* timers cleanup fh specific */
+		if (p->util_threshold_timer.cb) {
+			uloop_timeout_cancel(&p->util_threshold_timer);
+			p->util_threshold_timer.cb = NULL;
+		}
+
+		if (p->rcpi_threshold_timer.cb) {
+			uloop_timeout_cancel(&p->rcpi_threshold_timer);
+			p->rcpi_threshold_timer.cb = NULL;
+		}
+
 		if (p->cfg->util_threshold > 0) {
 			p->util_threshold_timer.cb =
 				agent_util_threshold_timer_cb;