diff --git a/mwifiex_8997/mlan/mlan_ioctl.h b/mwifiex_8997/mlan/mlan_ioctl.h
index 7967f45..a0ea0b0 100755
--- a/mwifiex_8997/mlan/mlan_ioctl.h
+++ b/mwifiex_8997/mlan/mlan_ioctl.h
@@ -1214,7 +1214,7 @@ typedef struct _mlan_ds_bss {
 
 /** Type definition of mlan_ds_custom_reg_domain */
 typedef struct _mlan_ds_custom_reg_domain {
-	t_u8 cfg_len;
+	t_u16 cfg_len;
 	t_u8 cfg_buf[0];
 } mlan_ds_custom_reg_domain;
 /*-----------------------------------------------------------------*/
diff --git a/mwifiex_8997/mlinux/mlan_ioctl.h b/mwifiex_8997/mlinux/mlan_ioctl.h
index 7967f45..a0ea0b0 100755
--- a/mwifiex_8997/mlinux/mlan_ioctl.h
+++ b/mwifiex_8997/mlinux/mlan_ioctl.h
@@ -1214,7 +1214,7 @@ typedef struct _mlan_ds_bss {
 
 /** Type definition of mlan_ds_custom_reg_domain */
 typedef struct _mlan_ds_custom_reg_domain {
-	t_u8 cfg_len;
+	t_u16 cfg_len;
 	t_u8 cfg_buf[0];
 } mlan_ds_custom_reg_domain;
 /*-----------------------------------------------------------------*/
diff --git a/mwifiex_8997/mlinux/moal_eth_ioctl.c b/mwifiex_8997/mlinux/moal_eth_ioctl.c
index a4e8a40..e0c6ea0 100755
--- a/mwifiex_8997/mlinux/moal_eth_ioctl.c
+++ b/mwifiex_8997/mlinux/moal_eth_ioctl.c
@@ -4135,13 +4135,15 @@ done:
  *
  * @return         0 --success, otherwise fail
  */
+
+#define CMD_SCANCFG_DATA_LEN	8
 int
 woal_priv_set_get_scancfg(moal_private *priv, t_u8 *respbuf, t_u32 respbuflen)
 {
 	int ret = 0;
 	int user_data_len = 0;
-	int arg_len = 8;
-	int data[arg_len];
+#define CMD_SCANCFG_DATA_LEN	8
+	int data[CMD_SCANCFG_DATA_LEN];
 	mlan_ds_scan *scan = NULL;
 	mlan_ioctl_req *req = NULL;
 	mlan_status status = MLAN_STATUS_SUCCESS;
diff --git a/mwifiex_8997/mlinux/moal_priv.c b/mwifiex_8997/mlinux/moal_priv.c
index 22d86ed..6f14ee9 100755
--- a/mwifiex_8997/mlinux/moal_priv.c
+++ b/mwifiex_8997/mlinux/moal_priv.c
@@ -4814,8 +4814,8 @@ static int
 woal_set_get_scan_cfg(moal_private *priv, struct iwreq *wrq)
 {
 	int ret = 0;
-	int arg_len = 7;
-	int data[arg_len], copy_len;
+#define	WOAL_SCAN_CFG_DATA_LEN	7
+	int data[WOAL_SCAN_CFG_DATA_LEN], copy_len;
 	mlan_ds_scan *scan = NULL;
 	mlan_ioctl_req *req = NULL;
 	int data_length = wrq->u.data.length;
@@ -4828,7 +4828,7 @@ woal_set_get_scan_cfg(moal_private *priv, struct iwreq *wrq)
 		ret = -ENOMEM;
 		goto done;
 	}
-	if (data_length > arg_len) {
+	if (data_length > WOAL_SCAN_CFG_DATA_LEN) {
 		ret = -EINVAL;
 		goto done;
 	}