diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 5abc0fbc81..328b1ffe62 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -27,4 +27,4 @@ jobs:
           # The exclude_file contains lines of code that should be ignored. This is useful for individual lines which have non-words that can safely be ignored.
         exclude_file: '.codespellexcludelines'
           # To skip files entirely from being processed, add it to the following list:
-        skip: '*.cproject,*.der,*.mtpj,*.pem,*.vcxproj,.git,*.launch,*.scfg,*/README_jp.txt'
+        skip: '*.cproject,*.der,*.mtpj,*.pem,*.vcxproj,.git,*.launch,*.scfg'
diff --git a/IDE/Renesas/cs+/Projects/t4_demo/README_jp.txt b/IDE/Renesas/cs+/Projects/t4_demo/README_jp.txt
index d03d443714..deeec5c618 100644
--- a/IDE/Renesas/cs+/Projects/t4_demo/README_jp.txt
+++ b/IDE/Renesas/cs+/Projects/t4_demo/README_jp.txt
@@ -1,71 +1,71 @@
-wolfSSL/AlphaProjectƒ{�[ƒhƒfƒ‚�@ƒZƒbƒgƒAƒbƒvƒKƒCƒh
+wolfSSL/AlphaProjectボードデモ　セットアップガイド
 
-‚±‚̃fƒ‚‚͈ȉº‚̊‹«‚ŃeƒXƒg‚µ‚Ä‚¢‚Ü‚·�B
+��デモ�以下�環境�テスト�����。
 
   Renesas : CS+ v6.01, v8.01
   Board   : AP-RX71M-0A
   wolfSSL : 3.15.3, 4.0.0
 
-ƒZƒbƒgƒAƒbƒvŽè�‡�F
+セットアップ手順：
 
-‚P�Dƒ\ƒtƒgƒEƒFƒA‚Ì“üŽè
-�@- APƒ{�[ƒh•t‘®‚̃\ƒtƒgƒEƒFƒAˆêŽ®‚ð“K“–‚ȃtƒHƒ‹ƒ_�[‰º‚ɉ𓀂µ‚Ü‚·�B
-�@- “¯‚¶ƒtƒHƒ‹ƒ_�[‰º‚ÉwolfsslˆêŽ®‚ð‰ð“€‚µ‚Ü‚·�B
+１．ソフトウェア�入手
+　- APボード付属�ソフトウェア一�を�当�フォルダー下�解����。
+　- ��フォルダー下�wolfssl一�を解����。
 
-‚Q�DwolfSSL‚̃ZƒbƒgƒAƒbƒv
-�@- CS+‚É‚Äwolfssl\IDE\Renesas\cs+\Project‰º‚Ìwolfssl\wolfssl_lib.mtpj‚ðŠJ‚«
-�@�@wolfSSLƒ‰ƒCƒuƒ‰ƒŠ�[‚̃rƒ‹ƒh‚ð‚µ‚Ü‚·�B
-�@- “¯‚¶ƒtƒHƒ‹ƒ_‚̉º‚Ìt4_demo.mtpj‚ðŠJ‚«�Aƒfƒ‚ƒvƒ�ƒOƒ‰ƒ€‚̃rƒ‹ƒh‚ð‚µ‚Ü‚·�B
-�@‚±‚̃vƒ�ƒOƒ‰ƒ€‚àƒ‰ƒCƒuƒ‰ƒŠ�[Œ`Ž®‚Ńrƒ‹ƒh‚³‚ê‚Ü‚·�B
+２．wolfSSL�セットアップ
+　- CS+��wolfssl¥IDE¥Renesas¥cs+¥Project下�wolfssl¥wolfssl_lib.mtpjを開�
+　　wolfSSLライブラリー�ビルドを���。
+　- ��フォルダ�下�t4_demo.mtpjを開��デモプログラム�ビルドを���。
+　��プログラムもライブラリー形��ビルド�れ��。
 
-‚R�DAlphaProject‘¤‚̃ZƒbƒgƒAƒbƒv
+３．AlphaProject��セットアップ
   
-  !!** ƒTƒ“ƒvƒ‹ƒvƒ�ƒOƒ‰ƒ€ v2.0 ‚ðŽg—p‚·‚é�ê�‡‚Í�A_ether_ => _usbfunc_ **!!
-  !!** ‚Æ’u‚«Š·‚¦‚Ä‚­‚¾‚³‚¢                                           **!!
+  !!** サンプルプログラム v2.0 を使用�る場���_ether_ => _usbfunc_ **!!
+  !!** �置��������                                           **!!
 
-�@ƒfƒ‚‚Íap_rx71m_0a_sample_cs\Sample\ap_rx71m_0a_ether_sample_csƒtƒHƒ‹ƒ_‰º‚Ì
-�@ap_rx71m_0a_ether_sample_cs.mtpjƒvƒ�ƒWƒFƒNƒg‚ð—˜—p‚µ‚Ü‚·�B
-�@
-�@- ap_rx71m_0a_sample_cs\Sample\ap_rx71m_0a_ether_sample_cs\srcƒtƒHƒ‹ƒ_‰º‚Ì
-�@AP_RX71M_0A.cƒtƒ@ƒCƒ‹‚ðŠJ‚«�A
-�@‚X‚V�s–Ú‚Ìecho_srv_init()‚̉º‚ÉwolfSSL_init()‚ð‘}“ü‚µ‚Ü‚·�B
+　デモ�ap_rx71m_0a_sample_cs¥Sample¥ap_rx71m_0a_ether_sample_csフォルダ下�
+　ap_rx71m_0a_ether_sample_cs.mtpjプロジェクトを利用���。
+　
+　- ap_rx71m_0a_sample_cs¥Sample¥ap_rx71m_0a_ether_sample_cs¥srcフォルダ下�
+　AP_RX71M_0A.cファイルを開��
+　９７行目�echo_srv_init()�下�wolfSSL_init()を挿入���。
 
 ===
         sci_init();
         can_init();
         echo_srv_init();
-        wolfSSL_init(); <- ‚±‚Ì�s‚ð‘}“ü
+        wolfSSL_init(); <- ��行を挿入
 ===
 
-!!** ƒTƒ“ƒvƒ‹ƒvƒ�ƒOƒ‰ƒ€ v2.0 ‚ðŽg—p‚·‚é�ê�‡‚Í�A‰º‹L                   **!!
+!!** サンプルプログラム v2.0 を使用�る場���下記                   **!!
 ===
         CanInit();
         SciInit();
         EthernetAppInit();
         UsbfInit();
-        wolfSSL_init(); <- ‚±‚Ì�s‚ð‘}“ü
+        wolfSSL_init(); <- ��行を挿入
 ===
 !!**********************************************************************!!
 
-�@- ap_rx71m_0a_sample_cs\Sample\ap_rx71m_0a_ether_sample_cs\src\smc_gen\r_bsp_config.h
-�@‚ðŠJ‚«�AƒXƒ^ƒbƒNƒTƒCƒY‚ƃq�[ƒvƒTƒCƒY‚ðˆÈ‰º‚̂悤‚É�ݒ肵‚Ü‚·�B
-�@
-�@120�s–Ú #pragma stacksize su=0x2000
-�@139�s–Ú #define BSP_CFG_HEAP_BYTES  (0xa000)
-
-!!** ƒTƒ“ƒvƒ‹ƒvƒ�ƒOƒ‰ƒ€ v2.0 ‚ðŽg—p‚·‚é�ê�‡‚Í�A‰º‹L                   **!!
-�@- ap_rx71m_0a_sample_cs\Sample\ap_rx71m_0a_usbfunc_sample_cs\src\smc_gen\r_bsp_config.h
-�@‚ðŠJ‚«�AƒXƒ^ƒbƒNƒTƒCƒY‚ƃq�[ƒvƒTƒCƒY‚ðˆÈ‰º‚̂悤‚É�ݒ肵‚Ü‚·�B
-�@154�s–Ú #pragma stacksize su=0x2000
-�@175�s–Ú #define BSP_CFG_HEAP_BYTES  (0xa000)
+　- ap_rx71m_0a_sample_cs¥Sample¥ap_rx71m_0a_ether_sample_cs¥src¥smc_gen¥r_bsp_config.h
+　を開��スタックサイズ�ヒープサイズを以下�よ��設定���。
+　
+　120行目 #pragma stacksize su=0x2000
+　139行目 #define BSP_CFG_HEAP_BYTES  (0xa000)
+
+!!** サンプルプログラム v2.0 を使用�る場���下記                   **!!
+　- ap_rx71m_0a_sample_cs¥Sample¥ap_rx71m_0a_usbfunc_sample_cs¥src¥smc_gen¥r_bsp_config.h
+　を開��スタックサイズ�ヒープサイズを以下�よ��設定���。
+　154行目 #pragma stacksize su=0x2000
+　175行目 #define BSP_CFG_HEAP_BYTES  (0xa000)
 !!**********************************************************************!!
 
-�@- IPƒAƒhƒŒƒX‚̃fƒtƒHƒ‹ƒg’l‚͈ȉº‚̂悤‚É‚È‚Á‚Ä‚¢‚Ü‚·�B
-�@•K—v‚ª‚ ‚ê‚Î�ASample\ap_rx71m_0a_ether_sample_cs\src\r_t4_rx\src\config_tcpudp.c
-�@“à‚Ì139�s–Ú‚©‚ç‚Ì’è‹`‚ð•Ï�X‚µ‚Ü‚·�B
-�@!!** ƒTƒ“ƒvƒ‹ƒvƒ�ƒOƒ‰ƒ€ v2.0 ‚ðŽg—p‚·‚é�ê�‡‚Í�A‰º‹L                   **!!
-  Sample\ap_rx71m_0a_usbfunc_sample_cs\src\tcp_sample\src\config_tcpudp.c
-  “à‚Ì166�s–Ú‚©‚ç‚Ì’è‹`‚ð•Ï�X‚µ‚Ü‚·�B
+　- IPアドレス�デフォルト値�以下�よ��������。
+　必���れ��Sample¥ap_rx71m_0a_ether_sample_cs¥src¥r_t4_rx¥src¥config_tcpudp.c
+　内�139行目�ら�定義を変更���。
+　!!** サンプルプログラム v2.0 を使用�る場���下記                   **!!
+  Sample¥ap_rx71m_0a_usbfunc_sample_cs¥src¥tcp_sample¥src¥config_tcpudp.c
+  内�166行目�ら�定義を変更���。
   !!**********************************************************************!!
 
 ===
@@ -75,74 +75,74 @@ wolfSSL/AlphaProject
 ===
 
 
-�@- CS+‚Åap_rx71m_0a_ether_sample_cs.mtpjƒvƒ�ƒWƒFƒNƒg‚ðŠJ‚«�AwolfSSL‚ƃfƒ‚ƒ‰ƒCƒuƒ‰ƒŠ‚ð
-�@“o˜^‚µ‚Ü‚·�BCC-RX(ƒrƒ‹ƒhƒc�[ƒ‹)->ƒŠƒ“ƒN�EƒIƒvƒVƒ‡ƒ“ƒ^ƒu->Žg—p‚·‚郉ƒCƒuƒ‰ƒŠ‚É
-�@ˆÈ‰º‚Ì“ñ‚‚̃tƒ@ƒCƒ‹‚ð“o˜^‚µ‚Ü‚·�B
-�@wolfssl\IDE\Renesas\cs+\Projects\wolfssl_lib\DefaultBuild\wolfssl_lib.lib
-�@wolfssl\IDE\Renesas\cs+\Projects\t4_demo\DefaultBuild\t4_demo.lib
+　- CS+�ap_rx71m_0a_ether_sample_cs.mtpjプロジェクトを開��wolfSSL�デモライブラリを
+　登録���。CC-RX(ビルドツール)->リンク・オプションタブ->使用�るライブラリ�
+　以下�二��ファイルを登録���。
+　wolfssl¥IDE¥Renesas¥cs+¥Projects¥wolfssl_lib¥DefaultBuild¥wolfssl_lib.lib
+　wolfssl¥IDE¥Renesas¥cs+¥Projects¥t4_demo¥DefaultBuild¥t4_demo.lib
 
-- CC-RX(ƒrƒ‹ƒhƒc�[ƒ‹)->ƒ‰ƒCƒuƒ‰ƒŠ�[ƒWƒFƒlƒŒ�[ƒVƒ‡ƒ“ƒ^ƒu->ƒ‰ƒCƒuƒ‰ƒŠ�[�\�¬‚ð�uC99�v‚É�A
-ctype.h‚ð—LŒø‚É‚·‚é‚ð�u‚Í‚¢�v‚É�ݒ肵‚Ü‚·�B
+- CC-RX(ビルドツール)->ライブラリージェ�レーションタブ->ライブラリー構�を「C99���
+ctype.hを有効��るを「����設定���。
 
-�@- ƒvƒ�ƒWƒFƒNƒg‚̃rƒ‹ƒh�Aƒ^�[ƒQƒbƒg‚ւ̃_ƒEƒ“ƒ��[ƒh‚ð‚µ‚½‚Ì‚¿�A•\Ž¦->ƒfƒoƒbƒO�EƒRƒ“ƒ\�[ƒ‹
-�@‚©‚çƒRƒ“ƒ\�[ƒ‹‚ð•\Ž¦‚³‚¹‚Ü‚·�BŽÀ�s‚ðŠJŽn‚·‚é‚ƃRƒ“ƒ\�[ƒ‹‚Ɉȉº‚Ì•\Ž¦‚ª�o—Í‚³‚ê‚Ü‚·�B
-�@
+　- プロジェクト�ビルド�ターゲット��ダウンロードを�����表示->デ�ッグ・コンソール
+　�らコンソールを表示����。実行を開始�る�コンソール�以下�表示�出力�れ��。
+　
 ===
-�@wolfSSL Demo
+　wolfSSL Demo
 t: test, b: benchmark, s: server, or c <IP addr> <Port>: client
 $
 ===
 
-tƒRƒ}ƒ“ƒh�FŠeˆÃ�†‰»ƒAƒ‹ƒSƒŠƒYƒ€‚ÌŠÈ’P‚ȃeƒXƒg‚ðŽÀ�s‚µ‚Ü‚·�B�Š—v‚̃Aƒ‹ƒSƒŠƒYƒ€‚ª
-�@‘g‚Ý�ž‚Ü‚ê‚Ä‚¢‚é‚©Šm”F‚·‚邱‚Æ‚ª‚Å‚«‚Ü‚·�B‘g‚Ý�ž‚ÞƒAƒ‹ƒSƒŠƒYƒ€‚̓rƒ‹ƒhƒIƒvƒVƒ‡ƒ“
-�@‚Å•Ï�X‚·‚邱‚Æ‚ª‚Å‚«‚Ü‚·�B�Ú‚µ‚­‚̓†�[ƒUƒ}ƒjƒ…ƒAƒ‹‚ðŽQ�Æ‚µ‚Ä‚­‚¾‚³‚¢�B
-bƒRƒ}ƒ“ƒh�FŠeˆÃ�†ƒAƒ‹ƒSƒŠƒYƒ€‚²‚Æ‚ÌŠÈ’P‚ȃxƒ“ƒ`ƒ}�[ƒN‚ðŽÀ�s‚µ‚Ü‚·�B
-sƒRƒ}ƒ“ƒh�FŠÈ’P‚ÈTLSƒT�[ƒo‚ð‹N“®‚µ‚Ü‚·�B‹N“®‚·‚é‚ƃrƒ‹ƒhŽž‚ÌIPƒAƒhƒŒƒX�A
-�@ƒ|�[ƒg50000‚É‚ÄTLS�Ú‘±‚ð‘Ò‚¿‚Ü‚·�B
-cƒRƒ}ƒ“ƒh�FŠÈ’P‚ÈTLSƒNƒ‰ƒCƒAƒ“ƒg‚ð‹N“®‚µ‚Ü‚·�B‹N“®‚·‚é‚Æ‘æˆêƒA�[ƒMƒ…ƒ�ƒ“ƒg‚ÅŽw’肳‚ꂽ
-�@IPƒAƒhƒŒƒX�A‘æ“ñƒA�[ƒMƒ…ƒ�ƒ“ƒg‚ÅŽw’肳‚ꂽƒ|�[ƒg‚ɑ΂µ‚ÄTLS�Ú‘±‚µ‚Ü‚·�B
-
-‚¢‚¸‚ê‚̃Rƒ}ƒ“ƒh‚à‚P‰ñ‚Ì‚ÝŽÀ�s‚µ‚Ü‚·�BŒJ‚è•Ô‚µŽÀ�s‚µ‚½‚¢�ê�‡‚Í�AMPU‚ðƒŠƒZƒbƒg‚µ‚Ä
-�Ä‹N“®‚µ‚Ü‚·�B
-
-‚S�D‘ÎŒüƒeƒXƒg
-�@ƒfƒ‚‚Ì‚“�A‚ƒƒRƒ}ƒ“ƒh‚ðŽg‚Á‚Ä�A‘¼‚Ì‹@Ší‚ÆŠÈ’P‚È‘ÎŒüƒeƒXƒg‚ð‚·‚é‚±‚Æ‚ª‚Å‚«‚Ü‚·�B
-�@Ubuntu‚È‚Ç‚ÌGCC, makeŠÂ‹«�AWindows‚ÌVisual Studio‚È‚Ç‚Å
-�@‘ÎŒüƒeƒXƒg—p‚̃T�[ƒo�AƒNƒ‰ƒCƒAƒ“ƒg‚ðƒrƒ‹ƒh‚·‚邱‚Æ‚ª‚Å‚«‚Ü‚·�B
-
-�@GCC,makeƒRƒ}ƒ“ƒhŠÂ‹«‚Å‚Í�Aƒ_ƒEƒ“ƒ��[ƒh‰ð“€‚µ‚½wolfssl‚̃fƒBƒŒƒNƒgƒŠ‰º‚ňȉº‚Ì
-�@ƒRƒ}ƒ“ƒh‚ð”­�s‚·‚é‚Æ�Aƒ‰ƒCƒuƒ‰ƒŠ�AƒeƒXƒg—p‚̃Nƒ‰ƒCƒAƒ“ƒg�AƒT�[ƒo‚ȂLjꎮ‚ªƒrƒ‹ƒh
-�@‚³‚ê‚Ü‚·�B
-�@
-�@$ ./configure
-�@$ make check
-�@
-�@‚»‚ÌŒã�AˆÈ‰º‚̂悤‚ÈŽw’è‚ŃNƒ‰ƒCƒAƒ“ƒg‚Ü‚½‚̓T�[ƒo‚ð‹N“®‚µ‚Ä�Aƒ{�[ƒh�ã‚Ì
-�@ƒfƒ‚‚Æ‘ÎŒüƒeƒXƒg‚·‚邱‚Æ‚ª‚Å‚«‚Ü‚·�B
-�@
-�@PC‘¤�F
-�@$ ./examples/server/server -b -d
-�@ƒ{�[ƒh‘¤�F
-�@�@> c <IPƒAƒhƒŒƒX> 11111
-
-�@ƒ{�[ƒh‘¤�F
-�@�@> s
-�@PC‘¤�F�@
-�@$ ./examples/client/client -h <IPƒAƒhƒŒƒX> -p 50000
-�@
-�@
-�@Windows‚ÌVisual Studio‚Å‚Í�Aƒ_ƒEƒ“ƒ��[ƒh‰ð“€‚µ‚½wolfsslƒtƒHƒ‹ƒ_‰º‚Ìwolfssl64.sln
-�@‚ðŠJ‚«�Aƒ\ƒŠƒ…�[ƒVƒ‡ƒ“‚ðƒrƒ‹ƒh‚µ‚Ü‚·�BDebugƒtƒHƒ‹ƒ_‰º‚Ƀrƒ‹ƒh‚³‚ê‚éclient.exe‚Æ
-�@server.exe‚ð—˜—p‚µ‚Ü‚·�B
-�@
-  PC‘¤�F
-�@Debug> .\server -b -d
-�@ƒ{�[ƒh‘¤�F
-�@�@> c <IPƒAƒhƒŒƒX> 11111
-
-�@ƒ{�[ƒh‘¤�F
-�@�@> s
-�@PC‘¤�F
-�@Debug> .\client  -h <IPƒAƒhƒŒƒX> -p 50000
-
-ˆÈ�ã�A
\ No newline at end of file
+tコマンド：�暗�化アルゴリズム�簡��テストを実行���。所��アルゴリズム�
+　組�込�れ��る�確��る�������。組�込むアルゴリズム�ビルドオプション
+　�変更�る�������。詳���ユーザマニュアルを�照������。
+bコマンド：�暗�アルゴリズム���簡��ベン�マークを実行���。
+sコマンド：簡��TLSサー�を起動���。起動�る�ビルド時�IPアドレス�
+　�ート50000��TLS接続を待���。
+cコマンド：簡��TLSクライアントを起動���。起動�る�第一アーギュメント�指定�れ�
+　IPアドレス�第二アーギュメント�指定�れ��ート�対��TLS接続���。
+
+��れ�コマンドも１回��実行���。繰り返�実行���場���MPUをリセット��
+�起動���。
+
+４．対�テスト
+　デモ�ｓ�ｃコマンドを使���他�機器�簡��対�テストを�る�������。
+　Ubuntu���GCC, make環境�Windows�Visual Studio���
+　対�テスト用�サー��クライアントをビルド�る�������。
+
+　GCC,makeコマンド環境���ダウンロード解���wolfssl�ディレクトリ下�以下�
+　コマンドを発行�る��ライブラリ�テスト用�クライアント�サー���一��ビルド
+　�れ��。
+　
+　$ ./configure
+　$ make check
+　
+　��後�以下�よ��指定�クライアント���サー�を起動���ボード上�
+　デモ�対�テスト�る�������。
+　
+　PC�：
+　$ ./examples/server/server -b -d
+　ボード�：
+　　> c <IPアドレス> 11111
+
+　ボード�：
+　　> s
+　PC�：　
+　$ ./examples/client/client -h <IPアドレス> -p 50000
+　
+　
+　Windows�Visual Studio���ダウンロード解���wolfsslフォルダ下�wolfssl64.sln
+　を開��ソリューションをビルド���。Debugフォルダ下�ビルド�れるclient.exe�
+　server.exeを利用���。
+　
+  PC�：
+　Debug> .¥server -b -d
+　ボード�：
+　　> c <IPアドレス> 11111
+
+　ボード�：
+　　> s
+　PC�：
+　Debug> .¥client  -h <IPアドレス> -p 50000
+
+以上�
\ No newline at end of file
diff --git a/cmake/options.h.in b/cmake/options.h.in
index a496dda8d4..797d180fbd 100644
--- a/cmake/options.h.in
+++ b/cmake/options.h.in
@@ -131,7 +131,7 @@ extern "C" {
 #undef HAVE_POLY1305
 #cmakedefine HAVE_POLY1305
 #undef HAVE_PTHREAD
-#cmakedefine HAVE_PTHREAD
+#cmakedefine HAVE_PTHREAD 1
 #undef HAVE_REPRODUCIBLE_BUILD
 #cmakedefine HAVE_REPRODUCIBLE_BUILD
 #undef HAVE_SESSION_TICKET
diff --git a/configure.ac b/configure.ac
index 4f909e133f..2d99ca8391 100644
--- a/configure.ac
+++ b/configure.ac
@@ -6000,6 +6000,19 @@ else
 fi
 
 
+# C89 build
+AC_ARG_ENABLE([c89],
+    [AS_HELP_STRING([--enable-c89],[Build with C89 toolchain (default: disabled)])],
+    [ ENABLED_C89=$enableval ],
+    [ ENABLED_C89=no ]
+    )
+
+if test "$ENABLED_C89" = "yes"
+then
+    AM_CFLAGS="$AM_CFLAGS -DWOLF_C89"
+    test "$enable_inline" = "" && enable_inline=no
+fi
+
 # inline Build
 AC_ARG_ENABLE([inline],
     [AS_HELP_STRING([--enable-inline],[Enable inline functions (default: enabled)])],
@@ -9928,7 +9941,7 @@ AM_CONDITIONAL([USE_VALGRIND],[test "x$ENABLED_VALGRIND" = "xyes"])
 AM_CONDITIONAL([BUILD_MD4],[test "x$ENABLED_MD4" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_PWDBASED],[test "x$ENABLED_PWDBASED" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_SCRYPT],[test "x$ENABLED_SCRYPT" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
-AM_CONDITIONAL([BUILD_CRYPTONLY],[test "x$ENABLED_CRYPTONLY" = "xyes" && test "x$ENABLED_OPENSSLEXTRA" = "xno"])
+AM_CONDITIONAL([BUILD_CRYPTONLY],[test "x$ENABLED_CRYPTONLY" = "xyes"])
 AM_CONDITIONAL([BUILD_FASTMATH],[test "x$ENABLED_FASTMATH" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_HEAPMATH],[test "x$ENABLED_HEAPMATH" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_EXAMPLE_SERVERS],[test "x$ENABLED_EXAMPLES" = "xyes" && test "x$ENABLED_LEANTLS" = "xno"])
@@ -10497,6 +10510,7 @@ echo "   * ARM ASM SM3/SM4 Crypto      $ENABLED_ARMASM_CRYPTO_SM4"
 echo "   * RISC-V ASM                  $ENABLED_RISCV_ASM"
 echo "   * Write duplicate:            $ENABLED_WRITEDUP"
 echo "   * Xilinx Hardware Acc.:       $ENABLED_XILINX"
+echo "   * C89:                        $ENABLED_C89"
 echo "   * Inline Code:                $ENABLED_INLINE"
 echo "   * Linux AF_ALG:               $ENABLED_AFALG"
 echo "   * Linux KCAPI:                $ENABLED_KCAPI"
diff --git a/examples/asn1/asn1.c b/examples/asn1/asn1.c
index 92a0a19528..654b6f1613 100644
--- a/examples/asn1/asn1.c
+++ b/examples/asn1/asn1.c
@@ -66,7 +66,7 @@ static int asn1App_ReadFile(FILE* fp, unsigned char** pdata, word32* plen)
     word32 len = 0;
     size_t read_len;
     /* Allocate a minimum amount. */
-    unsigned char* data = (unsigned char*)malloc(DATA_INC_LEN);
+    unsigned char* data = (unsigned char*)XMALLOC(DATA_INC_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 
     if (data != NULL) {
         /* Read more data. */
@@ -74,7 +74,7 @@ static int asn1App_ReadFile(FILE* fp, unsigned char** pdata, word32* plen)
             unsigned char* p;
 
             if (ferror(fp)) {
-                free(data);
+                XFREE(data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
                 return IO_FAILED_E;
             }
 
@@ -87,10 +87,10 @@ static int asn1App_ReadFile(FILE* fp, unsigned char** pdata, word32* plen)
             }
 
             /* Make space for more data to be added to buffer. */
-            p = (unsigned char*)realloc(data, len + DATA_INC_LEN);
+            p = (unsigned char*)XREALLOC(data, len + DATA_INC_LEN, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             if (p == NULL) {
                 /* Reallocation failed - free current buffer. */
-                free(data);
+                XFREE(data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
                 data = NULL;
                 break;
             }
@@ -132,7 +132,7 @@ static int PrintDer(FILE* fp)
         /* Print DER/BER. */
         ret = wc_Asn1_PrintAll(&asn1, &opts, data, len);
         /* Dispose of buffer. */
-        free(data);
+        XFREE(data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
 
     return ret;
@@ -168,7 +168,7 @@ static int PrintBase64(FILE* fp)
             ret = wc_Asn1_PrintAll(&asn1, &opts, data, len);
         }
         /* Dispose of buffer. */
-        free(data);
+        XFREE(data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
 
     return ret;
@@ -280,7 +280,7 @@ static int PrintPem(FILE* fp, int pem_skip)
             ret = wc_Asn1_PrintAll(&asn1, &opts, data, len);
         }
         /* Dispose of buffer. */
-        free(data);
+        XFREE(data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
 
     return ret;
diff --git a/examples/client/client.c b/examples/client/client.c
index e8f4c53c6d..42a705d8b2 100644
--- a/examples/client/client.c
+++ b/examples/client/client.c
@@ -789,9 +789,9 @@ static int ClientBenchmarkThroughput(WOLFSSL_CTX* ctx, char* host, word16 port,
 
                     /* Compare TX and RX buffers */
                     if (XMEMCMP(tx_buffer, rx_buffer, (size_t)len) != 0) {
-                        free(tx_buffer);
+                        XFREE(tx_buffer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
                         tx_buffer = NULL;
-                        free(rx_buffer);
+                        XFREE(rx_buffer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
                         rx_buffer = NULL;
                         err_sys("Compare TX and RX buffers failed");
                     }
diff --git a/examples/pem/pem.c b/examples/pem/pem.c
index 75ea0222d3..f4e2d91ae0 100644
--- a/examples/pem/pem.c
+++ b/examples/pem/pem.c
@@ -100,7 +100,7 @@ static int pemApp_ReadFile(FILE* fp, unsigned char** pdata, word32* plen)
     word32 len = 0;
     size_t read_len;
     /* Allocate a minimum amount. */
-    unsigned char* data = (unsigned char*)malloc(DATA_INC_LEN + BLOCK_SIZE_MAX);
+    unsigned char* data = (unsigned char*)XMALLOC(DATA_INC_LEN + BLOCK_SIZE_MAX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 
     if (data != NULL) {
         /* Read more data. */
@@ -116,11 +116,11 @@ static int pemApp_ReadFile(FILE* fp, unsigned char** pdata, word32* plen)
             }
 
             /* Make space for more data to be added to buffer. */
-            p = (unsigned char*)realloc(data, len + DATA_INC_LEN +
-                BLOCK_SIZE_MAX);
+            p = (unsigned char*)XREALLOC(data, len + DATA_INC_LEN +
+                BLOCK_SIZE_MAX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             if (p == NULL) {
                 /* Reallocation failed - free current buffer. */
-                free(data);
+                XFREE(data, NULL, DYNAMIC_TYPE_TMP_BUFFER);
                 data = NULL;
                 break;
             }
@@ -560,7 +560,7 @@ static int EncryptDer(unsigned char* in, word32 in_len, char* password,
     }
     if (ret == 0) {
         /* Allocate memory for encrypted DER data. */
-        *enc = (unsigned char*)malloc(*enc_len);
+        *enc = (unsigned char*)XMALLOC(*enc_len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (*enc == NULL) {
             ret = 1;
         }
@@ -613,7 +613,7 @@ static int ConvDerToPem(unsigned char* in, word32 offset, word32 len,
     }
     if ((ret == 0) && (pem_len > 0)) {
         /* Allocate memory to hold PEM encoding. */
-        pem = (unsigned char*)malloc(pem_len);
+        pem = (unsigned char*)XMALLOC(pem_len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (pem == NULL) {
             ret = 1;
         }
@@ -624,7 +624,7 @@ static int ConvDerToPem(unsigned char* in, word32 offset, word32 len,
             type);
         if (ret <= 0) {
             fprintf(stderr, "Could not convert DER to PEM\n");
-            free(pem);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         }
         if (ret > 0) {
             *out = pem;
@@ -1025,16 +1025,16 @@ int main(int argc, char* argv[])
         wc_FreeDer(&der);
     }
     else if (out != NULL) {
-        free(out);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
 #if defined(WOLFSSL_DER_TO_PEM) && defined(WOLFSSL_ENCRYPTED_KEYS) && \
     !defined(NO_PWDBASED)
     if (enc != NULL) {
-        free(enc);
+        XFREE(enc, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
 #endif
     if (in != NULL) {
-        free(in);
+        XFREE(in, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
     if (ret < 0) {
         fprintf(stderr, "%s\n", wc_GetErrorString(ret));
diff --git a/examples/server/server.c b/examples/server/server.c
index 02b8b92b6e..0ff0cd9f65 100644
--- a/examples/server/server.c
+++ b/examples/server/server.c
@@ -422,7 +422,7 @@ int ServerEchoData(SSL* ssl, int clientfd, int echoData, int block,
     size_t xfer_bytes = 0;
     char* buffer;
 
-    buffer = (char*)malloc((size_t)block);
+    buffer = (char*)XMALLOC((size_t)block, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (!buffer) {
         err_sys_ex(runWithErrors, "Server buffer malloc failed");
     }
@@ -465,7 +465,7 @@ int ServerEchoData(SSL* ssl, int clientfd, int echoData, int block,
                         break;
                     }
                     if (err == WOLFSSL_ERROR_ZERO_RETURN) {
-                        free(buffer);
+                        XFREE(buffer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
                         return WOLFSSL_ERROR_ZERO_RETURN;
                     }
                 }
@@ -507,7 +507,7 @@ int ServerEchoData(SSL* ssl, int clientfd, int echoData, int block,
         }
     }
 
-    free(buffer);
+    XFREE(buffer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 
     if (throughput) {
 #ifdef __MINGW32__
@@ -3635,7 +3635,7 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
             else
                 printf("Get list of client's protocol name failed\n");
 
-            free(list);
+            (void)wolfSSL_ALPN_FreePeerProtocol(ssl, &list);
         }
 #endif
 
diff --git a/src/crl.c b/src/crl.c
index 5e359c7ae9..fa239517bf 100644
--- a/src/crl.c
+++ b/src/crl.c
@@ -784,7 +784,7 @@ static CRL_Entry* DupCRL_Entry(const CRL_Entry* ent, void* heap)
     #endif
         if (dupl->toBeSigned == NULL || dupl->signature == NULL
         #ifdef WC_RSA_PSS
-            /* allow sigParamsSz is zero and malloc(0) to return NULL */
+            /* allow sigParamsSz is zero and XMALLOC(0) to return NULL */
             || (dupl->sigParams == NULL && dupl->sigParamsSz != 0)
         #endif
         ) {
diff --git a/wolfcrypt/benchmark/benchmark.c b/wolfcrypt/benchmark/benchmark.c
index fe244b6b68..2e3200bf62 100644
--- a/wolfcrypt/benchmark/benchmark.c
+++ b/wolfcrypt/benchmark/benchmark.c
@@ -3067,8 +3067,8 @@ static void* benchmarks_do(void* args)
         bench_buf_size += 16 - (bench_buf_size % 16);
 
 #ifdef WOLFSSL_AFALG_XILINX_AES
-    bench_plain = (byte*)aligned_alloc(64, (size_t)bench_buf_size + 16);
-    bench_cipher = (byte*)aligned_alloc(64, (size_t)bench_buf_size + 16);
+    bench_plain = (byte*)aligned_alloc(64, (size_t)bench_buf_size + 16); /* native heap */
+    bench_cipher = (byte*)aligned_alloc(64, (size_t)bench_buf_size + 16); /* native heap */
 #else
     bench_plain = (byte*)XMALLOC((size_t)bench_buf_size + 16,
                                  HEAP_HINT, DYNAMIC_TYPE_WOLF_BIGINT);
diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index bf9d5886b7..59e34e12ff 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -16115,7 +16115,6 @@ word32 SetOthername(void *name, byte *output)
     WOLFSSL_ASN1_OTHERNAME *nm = (WOLFSSL_ASN1_OTHERNAME *)name;
     char *nameStr = NULL;
     word32 nameSz = 0;
-    word32 len = 0;
 
     if ((nm == NULL) || (nm->value == NULL)) {
         WOLFSSL_MSG("otherName value is NULL");
@@ -16125,11 +16124,13 @@ word32 SetOthername(void *name, byte *output)
     nameStr = nm->value->value.utf8string->data;
     nameSz = (word32)nm->value->value.utf8string->length;
 
-    len = nm->type_id->objSz +
-          SetHeader(ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC, nameSz + 2, NULL, 0) +
-          SetHeader(CTC_UTF8, nameSz, NULL, 0) + nameSz;
-
-    if (output != NULL) {
+    if (output == NULL) {
+        return nm->type_id->objSz +
+            SetHeader(ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC, nameSz + 2, NULL, 0) +
+            SetHeader(CTC_UTF8, nameSz, NULL, 0) + nameSz;
+    }
+    else {
+        const byte *output_start = output;
         /* otherName OID */
         XMEMCPY(output, nm->type_id->obj, nm->type_id->objSz);
         output += nm->type_id->objSz;
@@ -16137,12 +16138,19 @@ word32 SetOthername(void *name, byte *output)
         output += SetHeader(ASN_CONSTRUCTED | ASN_CONTEXT_SPECIFIC, nameSz + 2,
                             output, 0);
 
+        /* work around false positive from -fstack-protector */
+        PRAGMA_GCC_DIAG_PUSH
+        PRAGMA_GCC("GCC diagnostic ignored \"-Wstringop-overflow\"")
+
         output += SetHeader(CTC_UTF8, nameSz, output, 0);
 
+        PRAGMA_GCC_DIAG_POP
+
         XMEMCPY(output, nameStr, nameSz);
-    }
 
-    return len;
+        output += nameSz;
+        return (word32)(output - output_start);
+    }
 }
 #endif /* OPENSSL_EXTRA */
 
@@ -21826,7 +21834,7 @@ enum {
 #ifdef WC_RSA_PSS
     RPKCERTASN_IDX_SPUBKEYINFO_ALGO_P_SEQ,
 #endif
-    RPKCERTASN_IDX_SPUBKEYINFO_PUBKEY,
+    RPKCERTASN_IDX_SPUBKEYINFO_PUBKEY
 };
 
 #endif /* HAVE_RPK */
diff --git a/wolfcrypt/src/memory.c b/wolfcrypt/src/memory.c
index 75d03895e6..0a174bb605 100644
--- a/wolfcrypt/src/memory.c
+++ b/wolfcrypt/src/memory.c
@@ -69,9 +69,9 @@ Possible memory options:
 void *z_realloc(void *ptr, size_t size)
 {
     if (ptr == NULL)
-        ptr = malloc(size);
+        ptr = malloc(size); /* native heap */
     else
-        ptr = realloc(ptr, size);
+        ptr = realloc(ptr, size); /* native heap */
 
     return ptr;
 }
@@ -360,7 +360,7 @@ void* wolfSSL_Malloc(size_t size)
         }
         #endif
 
-        res = malloc(size);
+        res = malloc(size); /* native heap */
     #else
         WOLFSSL_MSG("No malloc available");
     #endif
@@ -401,7 +401,7 @@ void* wolfSSL_Malloc(size_t size)
         #endif
         }
         else {
-            free(res); /* clear */
+            free(res); /* native heap */
         }
         gMemFailCount = gMemFailCountSeed; /* reset */
         return NULL;
@@ -445,7 +445,7 @@ void wolfSSL_Free(void *ptr)
     }
     else {
     #ifndef WOLFSSL_NO_MALLOC
-        free(ptr);
+        free(ptr); /* native heap */
     #else
         WOLFSSL_MSG("No free available");
     #endif
@@ -503,7 +503,7 @@ void* wolfSSL_Realloc(void *ptr, size_t size)
     }
     else {
     #ifndef WOLFSSL_NO_MALLOC
-        res = realloc(ptr, size);
+        res = realloc(ptr, size); /* native heap */
     #else
         WOLFSSL_MSG("No realloc available");
     #endif
@@ -1002,7 +1002,7 @@ void* wolfSSL_Malloc(size_t size, void* heap, int type)
     /* check for testing heap hint was set */
 #ifdef WOLFSSL_HEAP_TEST
     if (heap == (void*)WOLFSSL_HEAP_TEST) {
-        return malloc(size);
+        return malloc(size); /* native heap */
     }
 #endif
 
@@ -1013,7 +1013,7 @@ void* wolfSSL_Malloc(size_t size, void* heap, int type)
             if (type == DYNAMIC_TYPE_CTX || type == DYNAMIC_TYPE_METHOD ||
                                             type == DYNAMIC_TYPE_CERT_MANAGER) {
                 WOLFSSL_MSG("ERROR allowing null heap hint for ctx/method");
-                res = malloc(size);
+                res = malloc(size); /* native heap */
             }
             else {
                 WOLFSSL_MSG("ERROR null heap hint passed into XMALLOC");
@@ -1022,11 +1022,11 @@ void* wolfSSL_Malloc(size_t size, void* heap, int type)
         #else
         #ifndef WOLFSSL_NO_MALLOC
             #ifdef FREERTOS
-                res = pvPortMalloc(size);
+                res = pvPortMalloc(size); /* native heap */
             #elif defined(WOLFSSL_EMBOS)
                 res = OS_HEAP_malloc(size);
             #else
-                res = malloc(size);
+                res = malloc(size); /* native heap */
             #endif
 
             #ifdef WOLFSSL_DEBUG_MEMORY
@@ -1189,7 +1189,7 @@ void wolfSSL_Free(void *ptr, void* heap, int type)
         #ifdef WOLFSSL_DEBUG_MEMORY
             fprintf(stderr, "Free: %p at %s:%d\n", pt, func, line);
         #endif
-            return free(ptr);
+            return free(ptr); /* native heap */
         }
     #endif
 
@@ -1206,11 +1206,11 @@ void wolfSSL_Free(void *ptr, void* heap, int type)
         #endif
         #ifndef WOLFSSL_NO_MALLOC
             #ifdef FREERTOS
-                vPortFree(ptr);
+                vPortFree(ptr); /* native heap */
             #elif defined(WOLFSSL_EMBOS)
-                OS_HEAP_free(ptr);
+                OS_HEAP_free(ptr); /* native heap */
             #else
-                free(ptr);
+                free(ptr); /* native heap */
             #endif
             #ifdef WOLFSSL_DEBUG_MEMORY
             fprintf(stderr, "Free: %p at %s:%d\n", ptr, func, line);
@@ -1335,7 +1335,7 @@ void* wolfSSL_Realloc(void *ptr, size_t size, void* heap, int type)
     /* check for testing heap hint was set */
 #ifdef WOLFSSL_HEAP_TEST
     if (heap == (void*)WOLFSSL_HEAP_TEST) {
-        return realloc(ptr, size);
+        return realloc(ptr, size); /* native heap */
     }
 #endif
 
@@ -1344,7 +1344,7 @@ void* wolfSSL_Realloc(void *ptr, size_t size, void* heap, int type)
             WOLFSSL_MSG("ERROR null heap hint passed in to XREALLOC");
         #endif
         #ifndef WOLFSSL_NO_MALLOC
-            res = realloc(ptr, size);
+            res = realloc(ptr, size); /* native heap */
         #else
             WOLFSSL_MSG("NO heap found to use for realloc");
         #endif /* WOLFSSL_NO_MALLOC */
@@ -1493,7 +1493,7 @@ void* XMALLOC(size_t n, void* heap, int type)
             return NULL;
     }
 
-    return malloc(n);
+    return malloc(n); /* native heap */
 }
 
 void* XREALLOC(void *p, size_t n, void* heap, int type)
@@ -1514,7 +1514,7 @@ void* XREALLOC(void *p, size_t n, void* heap, int type)
             return NULL;
     }
 
-    return realloc(p, n);
+    return realloc(p, n); /* native heap */
 }
 
 void XFREE(void *p, void* heap, int type)
@@ -1527,7 +1527,7 @@ void XFREE(void *p, void* heap, int type)
     if (type == DYNAMIC_TYPE_OUT_BUFFER)
         return;  /* do nothing, static pool */
 
-    free(p);
+    free(p); /* native heap */
 }
 
 #endif /* HAVE_IO_POOL */
@@ -1554,7 +1554,7 @@ void *xmalloc(size_t n, void* heap, int type, const char* func,
 #endif
     }
     else
-        p32 = malloc(n + sizeof(word32) * 4);
+        p32 = malloc(n + sizeof(word32) * 4); /* native heap */
 
     if (p32 != NULL) {
         p32[0] = (word32)n;
@@ -1597,7 +1597,7 @@ void *xrealloc(void *p, size_t n, void* heap, int type, const char* func,
 #endif
     }
     else
-        p32 = realloc(oldp32, n + sizeof(word32) * 4);
+        p32 = realloc(oldp32, n + sizeof(word32) * 4); /* native heap */
 
     if (p32 != NULL) {
         p32[0] = (word32)n;
@@ -1643,7 +1643,7 @@ void xfree(void *p, void* heap, int type, const char* func, const char* file,
 #endif
         }
         else
-            free(p32);
+            free(p32); /* native heap */
     }
 
     (void)heap;
diff --git a/wolfcrypt/src/rsa.c b/wolfcrypt/src/rsa.c
index 3b4fd6f5cc..6757c6d121 100644
--- a/wolfcrypt/src/rsa.c
+++ b/wolfcrypt/src/rsa.c
@@ -2801,7 +2801,9 @@ static int wc_RsaFunctionSync(const byte* in, word32 inLen, byte* out,
 
     ret = wc_RsaEncryptSize(key);
     if (ret < 0) {
+#ifdef DEBUG_WOLFSSL
         WOLFSSL_MSG_EX("wc_RsaEncryptSize failed err = %d", ret);
+#endif
         return ret;
     }
     keyLen = (word32)ret;
diff --git a/wolfcrypt/src/sp_dsp32.c b/wolfcrypt/src/sp_dsp32.c
index 4c3bc9f3ce..e65862d8e2 100644
--- a/wolfcrypt/src/sp_dsp32.c
+++ b/wolfcrypt/src/sp_dsp32.c
@@ -4538,21 +4538,21 @@ void wc_ecc_fp_free(void)
 }
 
 
-AEEResult wolfSSL_open(const char *uri, remote_handle64 *handle) 
+AEEResult wolfSSL_open(const char *uri, remote_handle64 *handle)
 {
   /* can be any value or ignored, rpc layer doesn't care
    * also ok
    * *handle = 0;
    * *handle = 0xdeadc0de;
    */
-   *handle = (remote_handle64)malloc(1);
+   *handle = (remote_handle64)XMALLOC(1, NULL, DYNAMIC_TYPE_ECC);
    return 0;
 }
 
-AEEResult wolfSSL_close(remote_handle64 handle) 
+AEEResult wolfSSL_close(remote_handle64 handle)
 {
    if (handle)
-      free((void*)handle);
+      XFREE((void*)handle, NULL, DYNAMIC_TYPE_ECC);
    return 0;
 }
 #endif /* HAVE_ECC_VERIFY */
diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index b8b6221a0b..78cdeee78b 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -1782,7 +1782,7 @@ int wolfSSL_HwPkMutexUnLock(void)
     static void destruct_key(void *buf)
     {
         if (buf != NULL) {
-            free(buf);
+            XFREE(buf, NULL, DYNAMIC_TYPE_OS_BUF);
         }
     }
 
@@ -1911,7 +1911,7 @@ int wolfSSL_HwPkMutexUnLock(void)
 
         key_ptr = pthread_getspecific(key_own_hw_mutex);
         if (key_ptr == NULL) {
-            key_ptr = malloc(sizeof(int));
+            key_ptr = XMALLOC(sizeof(int), NULL, DYNAMIC_TYPE_OS_BUF);
             if (key_ptr == NULL) {
                 return MEMORY_E;
             }
@@ -3901,7 +3901,7 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
         XMEMSET(thread, 0, sizeof(*thread));
 
         thread->threadStack = (void *)XMALLOC(WOLFSSL_NETOS_STACK_SZ, NULL,
-                DYNAMIC_TYPE_TMP_BUFFER);
+                DYNAMIC_TYPE_OS_BUF);
         if (thread->threadStack == NULL)
             return MEMORY_E;
 
@@ -3923,7 +3923,7 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
                            2, 2,
                            1, TX_AUTO_START);
         if (result != TX_SUCCESS) {
-            free(thread->threadStack);
+            XFREE(thread->threadStack, NULL, DYNAMIC_TYPE_OS_BUF);
             thread->threadStack = NULL;
             return MEMORY_E;
         }
@@ -3934,7 +3934,7 @@ char* mystrnstr(const char* s1, const char* s2, unsigned int n)
     int wolfSSL_JoinThread(THREAD_TYPE thread)
     {
         /* TODO: maybe have to use tx_thread_delete? */
-        free(thread.threadStack);
+        XFREE(thread.threadStack, NULL, DYNAMIC_TYPE_OS_BUF);
         thread.threadStack = NULL;
         return 0;
     }
diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c
index 10dabe7960..eddd3f3890 100644
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -57516,7 +57516,7 @@ static void *my_Malloc_cb(size_t size)
 #endif
     malloc_cnt++;
     #ifndef WOLFSSL_NO_MALLOC
-        return malloc(size);
+        return malloc(size); /* native heap */
     #else
         WOLFSSL_MSG("No malloc available");
         (void)size;
@@ -57535,7 +57535,7 @@ static void my_Free_cb(void *ptr)
 #endif
     free_cnt++;
     #ifndef WOLFSSL_NO_MALLOC
-        free(ptr);
+        free(ptr); /* native heap */
     #else
         WOLFSSL_MSG("No free available");
         (void)ptr;
@@ -57553,7 +57553,7 @@ static void *my_Realloc_cb(void *ptr, size_t size)
 #endif
     realloc_cnt++;
     #ifndef WOLFSSL_NO_MALLOC
-        return realloc(ptr, size);
+        return realloc(ptr, size); /* native heap */
     #else
         WOLFSSL_MSG("No realloc available");
         (void)ptr;
diff --git a/wolfssl/callbacks.h b/wolfssl/callbacks.h
index 1010eca9e2..dc3ad892e7 100644
--- a/wolfssl/callbacks.h
+++ b/wolfssl/callbacks.h
@@ -36,7 +36,7 @@ enum { /* CALLBACK CONSTANTS */
     MAX_CIPHERNAME_SZ     =  24,
     MAX_TIMEOUT_NAME_SZ   =  24,
     MAX_PACKETS_HANDSHAKE =  14,       /* 12 for client auth plus 2 alerts */
-    MAX_VALUE_SZ          = 128,       /* all handshake packets but Cert should
+    MAX_VALUE_SZ          = 128        /* all handshake packets but Cert should
                                           fit here  */
 };
 
diff --git a/wolfssl/openssl/ec.h b/wolfssl/openssl/ec.h
index fb02641844..4067cff5fe 100644
--- a/wolfssl/openssl/ec.h
+++ b/wolfssl/openssl/ec.h
@@ -88,7 +88,7 @@ enum {
 #endif
 
     WOLFSSL_EC_EXPLICIT_CURVE  = 0x000,
-    WOLFSSL_EC_NAMED_CURVE  = 0x001,
+    WOLFSSL_EC_NAMED_CURVE  = 0x001
 };
 
 #ifndef OPENSSL_COEXIST
@@ -185,8 +185,8 @@ struct WOLFSSL_EC_KEY {
     word16 pkcs8HeaderSz;
 
     /* option bits */
-    byte inSet:1;                /* internal set from external ? */
-    byte exSet:1;                /* external set from internal ? */
+    WC_BITFIELD inSet:1;                /* internal set from external ? */
+    WC_BITFIELD exSet:1;                /* external set from internal ? */
 
     wolfSSL_Ref ref;             /* Reference count information. */
 };
@@ -451,7 +451,11 @@ typedef WOLFSSL_EC_KEY_METHOD         EC_KEY_METHOD;
 #define EC_GROUP_order_bits             wolfSSL_EC_GROUP_order_bits
 #define EC_GROUP_method_of              wolfSSL_EC_GROUP_method_of
 #ifndef NO_WOLFSSL_STUB
-#define EC_GROUP_set_point_conversion_form(...) WC_DO_NOTHING
+#ifdef WOLF_NO_VARIADIC_MACROS
+    #define EC_GROUP_set_point_conversion_form() WC_DO_NOTHING
+#else
+    #define EC_GROUP_set_point_conversion_form(...) WC_DO_NOTHING
+#endif
 #endif
 
 #define EC_METHOD_get_field_type        wolfSSL_EC_METHOD_get_field_type
diff --git a/wolfssl/openssl/evp.h b/wolfssl/openssl/evp.h
index 5d66164e6a..227146dc3e 100644
--- a/wolfssl/openssl/evp.h
+++ b/wolfssl/openssl/evp.h
@@ -732,8 +732,8 @@ struct WOLFSSL_EVP_CIPHER_CTX {
 #endif
 #if defined(HAVE_AESGCM) || defined(HAVE_AESCCM) || \
     defined(WOLFSSL_SM4_GCM) || defined(WOLFSSL_SM4_CCM)
-    byte    authIvGenEnable:1;
-    byte    authIncIv:1;
+    WC_BITFIELD authIvGenEnable:1;
+    WC_BITFIELD authIncIv:1;
 #endif
 #endif
 };
@@ -1253,7 +1253,7 @@ WOLFSSL_API int wolfSSL_EVP_SignInit_ex(WOLFSSL_EVP_MD_CTX* ctx,
 #define EVP_MD_block_size       wolfSSL_EVP_MD_block_size
 #define EVP_MD_type             wolfSSL_EVP_MD_type
 #ifndef NO_WOLFSSL_STUB
-#define EVP_MD_CTX_set_flags(...) WC_DO_NOTHING
+#define EVP_MD_CTX_set_flags(ctx, flags) WC_DO_NOTHING
 #endif
 
 #define EVP_Digest             wolfSSL_EVP_Digest
diff --git a/wolfssl/openssl/pem.h b/wolfssl/openssl/pem.h
index 8a7a6326ad..3666ab58a5 100644
--- a/wolfssl/openssl/pem.h
+++ b/wolfssl/openssl/pem.h
@@ -280,7 +280,7 @@ int wolfSSL_PEM_write_DHparams(XFILE fp, WOLFSSL_DH* dh);
 #define PEM_read_bio_EC_PUBKEY          wolfSSL_PEM_read_bio_EC_PUBKEY
 #define PEM_read_bio_ECPKParameters     wolfSSL_PEM_read_bio_ECPKParameters
 #ifndef NO_WOLFSSL_STUB
-#define PEM_write_bio_ECPKParameters(...) 0
+#define PEM_write_bio_ECPKParameters(out, x) 0
 #endif
 /* EVP_KEY */
 #define PEM_read_bio_PrivateKey         wolfSSL_PEM_read_bio_PrivateKey
diff --git a/wolfssl/openssl/rsa.h b/wolfssl/openssl/rsa.h
index 6e5dcfa232..c414fdf614 100644
--- a/wolfssl/openssl/rsa.h
+++ b/wolfssl/openssl/rsa.h
@@ -78,7 +78,7 @@ typedef struct WOLFSSL_RSA_METHOD {
     /* Name of RSA key implementation. */
     char *name;
     /* RSA method dynamically allocated. */
-    word16 dynamic:1;
+    WC_BITFIELD dynamic:1;
 } WOLFSSL_RSA_METHOD;
 
 #ifndef WOLFSSL_RSA_TYPE_DEFINED /* guard on redeclaration */
@@ -106,9 +106,9 @@ typedef struct WOLFSSL_RSA {
     int flags;                       /* Flags of implementation. */
 
     /* bits */
-    byte inSet:1;                    /* Internal set from external. */
-    byte exSet:1;                    /* External set from internal. */
-    byte ownRng:1;                   /* Rng needs to be free'd. */
+    WC_BITFIELD inSet:1;             /* Internal set from external. */
+    WC_BITFIELD exSet:1;             /* External set from internal. */
+    WC_BITFIELD ownRng:1;            /* Rng needs to be free'd. */
 } WOLFSSL_RSA;
 #endif
 
diff --git a/wolfssl/openssl/ssl.h b/wolfssl/openssl/ssl.h
index 8133a42ef1..2a24518ce1 100644
--- a/wolfssl/openssl/ssl.h
+++ b/wolfssl/openssl/ssl.h
@@ -835,7 +835,7 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define X509_REVOKED_get0_serialNumber   wolfSSL_X509_REVOKED_get0_serial_number
 #define X509_REVOKED_get0_revocationDate wolfSSL_X509_REVOKED_get0_revocation_date
 
-#define X509_check_purpose(...)         0
+#define X509_check_purpose(x, id, ca)   0
 
 #define OCSP_parse_url                  wolfSSL_OCSP_parse_url
 
@@ -980,7 +980,7 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define ASN1_STRING_print(x, y)         wolfSSL_ASN1_STRING_print ((WOLFSSL_BIO*)(x), (WOLFSSL_ASN1_STRING*)(y))
 #define d2i_DISPLAYTEXT                 wolfSSL_d2i_DISPLAYTEXT
 #ifndef NO_WOLFSSL_STUB
-#define ASN1_STRING_set_default_mask_asc(...) 1
+#define ASN1_STRING_set_default_mask_asc(p) 1
 #endif
 
 #define ASN1_GENERALSTRING              WOLFSSL_ASN1_STRING
@@ -1014,7 +1014,7 @@ wolfSSL_X509_STORE_set_verify_cb((WOLFSSL_X509_STORE *)(s), (WOLFSSL_X509_STORE_
 #define ASN1_IA5STRING_free            wolfSSL_ASN1_STRING_free
 #define ASN1_IA5STRING_set             wolfSSL_ASN1_STRING_set
 
-#define ASN1_PRINTABLE_type(...)        V_ASN1_PRINTABLESTRING
+#define ASN1_PRINTABLE_type(s, max)    V_ASN1_PRINTABLESTRING
 
 #define ASN1_UTCTIME_pr                 wolfSSL_ASN1_UTCTIME_pr
 
@@ -1565,7 +1565,7 @@ typedef WOLFSSL_SRTP_PROTECTION_PROFILE      SRTP_PROTECTION_PROFILE;
 #define PSK_MAX_IDENTITY_LEN            128
 #define SSL_CTX_clear_options           wolfSSL_CTX_clear_options
 
-#define SSL_CTX_add_server_custom_ext(...) 0
+#define SSL_CTX_add_server_custom_ext(ctx, ext_type, add_cb, free_cb, add_arg, parse_cb, parse_arg) 0
 
 #define SSL_get0_verified_chain         wolfSSL_get0_verified_chain
 #define X509_chain_up_ref               wolfSSL_X509_chain_up_ref
@@ -1573,8 +1573,8 @@ typedef WOLFSSL_SRTP_PROTECTION_PROFILE      SRTP_PROTECTION_PROFILE;
 #endif /* HAVE_STUNNEL || WOLFSSL_NGINX */
 
 #ifndef NO_WOLFSSL_STUB
-#define b2i_PrivateKey_bio(...)         NULL
-#define b2i_PVK_bio(...)                NULL
+#define b2i_PrivateKey_bio(in)          NULL
+#define b2i_PVK_bio(in, cb, u)          NULL
 #endif
 
 #define SSL_CTX_get_default_passwd_cb   wolfSSL_CTX_get_default_passwd_cb
@@ -1784,8 +1784,8 @@ typedef WOLFSSL_SRTP_PROTECTION_PROFILE      SRTP_PROTECTION_PROFILE;
 #define X509_OBJECT_retrieve_by_subject wolfSSL_X509_OBJECT_retrieve_by_subject
 
 #ifndef NO_WOLFSSL_STUB
-#define OBJ_create_objects(...)         WC_DO_NOTHING
-#define sk_SSL_COMP_free(...)           WC_DO_NOTHING
+#define OBJ_create_objects(in)          WC_DO_NOTHING
+#define sk_SSL_COMP_free(sk)            WC_DO_NOTHING
 #endif
 
 #define ASN1_OBJECT_new                 wolfSSL_ASN1_OBJECT_new
diff --git a/wolfssl/openssl/x509v3.h b/wolfssl/openssl/x509v3.h
index e5d2574f4d..082ae4e777 100644
--- a/wolfssl/openssl/x509v3.h
+++ b/wolfssl/openssl/x509v3.h
@@ -183,7 +183,7 @@ WOLFSSL_API WOLFSSL_ASN1_STRING* wolfSSL_a2i_IPADDRESS(const char* ipa);
 #define X509V3_EXT_d2i            wolfSSL_X509V3_EXT_d2i
 #define X509V3_EXT_add_nconf      wolfSSL_X509V3_EXT_add_nconf
 #ifndef NO_WOLFSSL_STUB
-#define X509V3_parse_list(...)    NULL
+#define X509V3_parse_list(line)   NULL
 #endif
 #define i2s_ASN1_OCTET_STRING     wolfSSL_i2s_ASN1_STRING
 #define a2i_IPADDRESS             wolfSSL_a2i_IPADDRESS
@@ -191,8 +191,8 @@ WOLFSSL_API WOLFSSL_ASN1_STRING* wolfSSL_a2i_IPADDRESS(const char* ipa);
 #define X509V3_EXT_conf_nid       wolfSSL_X509V3_EXT_conf_nid
 #define X509V3_set_ctx            wolfSSL_X509V3_set_ctx
 #ifndef NO_WOLFSSL_STUB
-#define X509V3_set_nconf(...)     WC_DO_NOTHING
-#define X509V3_EXT_cleanup(...)   WC_DO_NOTHING
+#define X509V3_set_nconf(ctx, conf) WC_DO_NOTHING
+#define X509V3_EXT_cleanup()      WC_DO_NOTHING
 #endif
 #define X509V3_set_ctx_test(ctx)  wolfSSL_X509V3_set_ctx(ctx, NULL, NULL, NULL, NULL, CTX_TEST)
 #define X509V3_set_ctx_nodb       wolfSSL_X509V3_set_ctx_nodb
diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h
index e721c71a10..d007316921 100644
--- a/wolfssl/ssl.h
+++ b/wolfssl/ssl.h
@@ -510,10 +510,10 @@ struct WOLFSSL_EVP_PKEY {
     word16 pkcs8HeaderSz;
 
     /* option bits */
-    byte ownDh:1;  /* if struct owns DH  and should free it */
-    byte ownEcc:1; /* if struct owns ECC and should free it */
-    byte ownDsa:1; /* if struct owns DSA and should free it */
-    byte ownRsa:1; /* if struct owns RSA and should free it */
+    WC_BITFIELD ownDh:1;  /* if struct owns DH  and should free it */
+    WC_BITFIELD ownEcc:1; /* if struct owns ECC and should free it */
+    WC_BITFIELD ownDsa:1; /* if struct owns DSA and should free it */
+    WC_BITFIELD ownRsa:1; /* if struct owns RSA and should free it */
 };
 
 struct WOLFSSL_X509_PKEY {
@@ -862,7 +862,7 @@ enum AlertLevel {
 enum SNICbReturn {
     warning_return = alert_warning,
     fatal_return = alert_fatal,
-    noack_return,
+    noack_return
 };
 
 /* WS_RETURN_CODE macro
@@ -2310,10 +2310,10 @@ WOLFSSL_API int wolfSSL_get_client_suites_sigalgs(const WOLFSSL* ssl,
         const byte** suites, word16* suiteSz,
         const byte** hashSigAlgo, word16* hashSigAlgoSz);
 typedef struct WOLFSSL_CIPHERSUITE_INFO {
-    byte rsaAuth:1;
-    byte eccAuth:1;
-    byte eccStatic:1;
-    byte psk:1;
+    WC_BITFIELD rsaAuth:1;
+    WC_BITFIELD eccAuth:1;
+    WC_BITFIELD eccStatic:1;
+    WC_BITFIELD psk:1;
 } WOLFSSL_CIPHERSUITE_INFO;
 WOLFSSL_API WOLFSSL_CIPHERSUITE_INFO wolfSSL_get_ciphersuite_info(byte first,
         byte second);
@@ -2456,7 +2456,7 @@ enum {
     WOLFSSL_OCSP_CHECKALL     = 4,
 
     WOLFSSL_CRL_CHECKALL = 1,
-    WOLFSSL_CRL_CHECK    = 2,
+    WOLFSSL_CRL_CHECK    = 2
 };
 
 /* Separated out from other enums because of size */
@@ -2503,7 +2503,7 @@ enum {
                   | WOLFSSL_OP_TLS_D5_BUG
                   | WOLFSSL_OP_TLS_BLOCK_PADDING_BUG
                   | WOLFSSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
-                  | WOLFSSL_OP_TLS_ROLLBACK_BUG),
+                  | WOLFSSL_OP_TLS_ROLLBACK_BUG)
 };
 
 #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL) || \
@@ -3571,7 +3571,7 @@ enum {
     WOLFSSL_BLOCK_TYPE = 2,
     WOLFSSL_STREAM_TYPE = 3,
     WOLFSSL_AEAD_TYPE = 4,
-    WOLFSSL_TLS_HMAC_INNER_SZ = 13, /* SEQ_SZ + ENUM + VERSION_SZ + LEN_SZ */
+    WOLFSSL_TLS_HMAC_INNER_SZ = 13 /* SEQ_SZ + ENUM + VERSION_SZ + LEN_SZ */
 };
 
 /* for GetBulkCipher and internal use
@@ -4061,7 +4061,7 @@ WOLFSSL_API void* wolfSSL_CTX_GetHeap(WOLFSSL_CTX* ctx, WOLFSSL* ssl);
 
 /* SNI types */
 enum {
-    WOLFSSL_SNI_HOST_NAME = 0,
+    WOLFSSL_SNI_HOST_NAME = 0
 };
 
 WOLFSSL_ABI WOLFSSL_API int wolfSSL_UseSNI(WOLFSSL* ssl, unsigned char type,
@@ -4081,7 +4081,7 @@ enum {
     WOLFSSL_SNI_ANSWER_ON_MISMATCH   = 0x02,
 
     /* Abort the handshake if the client didn't send a SNI request. */
-    WOLFSSL_SNI_ABORT_ON_ABSENCE     = 0x04,
+    WOLFSSL_SNI_ABORT_ON_ABSENCE     = 0x04
 };
 
 WOLFSSL_API void wolfSSL_SNI_SetOptions(WOLFSSL* ssl, unsigned char type,
@@ -4132,7 +4132,7 @@ enum {
     WOLFSSL_ALPN_NO_MATCH = 0,
     WOLFSSL_ALPN_MATCH    = 1,
     WOLFSSL_ALPN_CONTINUE_ON_MISMATCH = 2,
-    WOLFSSL_ALPN_FAILED_ON_MISMATCH = 4,
+    WOLFSSL_ALPN_FAILED_ON_MISMATCH = 4
 };
 
 enum {
@@ -4174,7 +4174,7 @@ enum {
     WOLFSSL_MFL_2_13 = 5, /* 8192 bytes *//* wolfSSL ONLY!!! */
     WOLFSSL_MFL_2_8  = 6, /*  256 bytes *//* wolfSSL ONLY!!! */
     WOLFSSL_MFL_MIN  = WOLFSSL_MFL_2_9,
-    WOLFSSL_MFL_MAX  = WOLFSSL_MFL_2_8,
+    WOLFSSL_MFL_MAX  = WOLFSSL_MFL_2_8
 };
 
 #ifndef NO_WOLFSSL_CLIENT
@@ -4336,6 +4336,7 @@ enum {
     WOLFSSL_PQC_MAX               = 12105,
 #endif /* WOLFSSL_ML_KEM */
 #endif /* HAVE_PQC */
+    WOLF_ENUM_DUMMY_LAST_ELEMENT(SSL_H)
 };
 
 enum {
@@ -4344,6 +4345,7 @@ enum {
     WOLFSSL_EC_PF_X962_COMP_PRIME = 1,
     WOLFSSL_EC_PF_X962_COMP_CHAR2 = 2,
 #endif
+    WOLF_ENUM_DUMMY_LAST_ELEMENT(SSL_H)
 };
 
 #ifdef HAVE_SUPPORTED_CURVES
@@ -5593,7 +5595,7 @@ WOLFSSL_API int wolfSSL_get_ephemeral_key(WOLFSSL* ssl, int keyAlgo,
 enum {
     WOLFSSL_CERT_TYPE_UNKNOWN = -1,
     WOLFSSL_CERT_TYPE_X509 = 0,
-    WOLFSSL_CERT_TYPE_RPK  = 2,
+    WOLFSSL_CERT_TYPE_RPK  = 2
 };
 #define MAX_CLIENT_CERT_TYPE_CNT 2
 #define MAX_SERVER_CERT_TYPE_CNT 2
diff --git a/wolfssl/wolfcrypt/hpke.h b/wolfssl/wolfcrypt/hpke.h
index 6e406ba05d..3bf61e5e47 100644
--- a/wolfssl/wolfcrypt/hpke.h
+++ b/wolfssl/wolfcrypt/hpke.h
@@ -42,7 +42,7 @@ enum {
     DHKEM_P384_HKDF_SHA384 = 0x0011,
     DHKEM_P521_HKDF_SHA512 = 0x0012,
     DHKEM_X25519_HKDF_SHA256 = 0x0020,
-    DHKEM_X448_HKDF_SHA512 = 0x0021,
+    DHKEM_X448_HKDF_SHA512 = 0x0021
 };
 
 #define DHKEM_P256_ENC_LEN 65
@@ -55,13 +55,13 @@ enum {
 enum {
     HKDF_SHA256 = 0x0001,
     HKDF_SHA384 = 0x0002,
-    HKDF_SHA512 = 0x0003,
+    HKDF_SHA512 = 0x0003
 };
 
 /* AEAD enum */
 enum {
     HPKE_AES_128_GCM = 0x0001,
-    HPKE_AES_256_GCM = 0x0002,
+    HPKE_AES_256_GCM = 0x0002
 };
 
 /* TODO better way of doing this */
diff --git a/wolfssl/wolfcrypt/logging.h b/wolfssl/wolfcrypt/logging.h
index fe2e108ee8..a60f70b499 100644
--- a/wolfssl/wolfcrypt/logging.h
+++ b/wolfssl/wolfcrypt/logging.h
@@ -178,7 +178,7 @@ WOLFSSL_API void wolfSSL_SetLoggingPrefix(const char* prefix);
     WOLFSSL_API void WOLFSSL_MSG_EX(const char* fmt, ...);
     #define HAVE_WOLFSSL_MSG_EX
 #else
-    #ifdef __WATCOMC__ /* does not allow variadic macros */
+    #ifdef WOLF_NO_VARIADIC_MACROS
         #define WOLFSSL_MSG_EX()    WC_DO_NOTHING
     #else
         #define WOLFSSL_MSG_EX(...) WC_DO_NOTHING
@@ -201,7 +201,11 @@ WOLFSSL_API void wolfSSL_SetLoggingPrefix(const char* prefix);
         #define WOLFSSL_MSG_EX(fmt, args...) \
                 WOLFSSL_MSG_EX2(__FILE__, __LINE__, fmt, ## args)
     #else
-        #define WOLFSSL_MSG_EX2(...) WC_DO_NOTHING
+        #ifdef WOLF_NO_VARIADIC_MACROS
+            #define WOLFSSL_MSG_EX2() WC_DO_NOTHING
+        #else
+            #define WOLFSSL_MSG_EX2(...) WC_DO_NOTHING
+        #endif
     #endif
 #endif
     WOLFSSL_API void WOLFSSL_BUFFER(const byte* buffer, word32 length);
@@ -213,7 +217,10 @@ WOLFSSL_API void wolfSSL_SetLoggingPrefix(const char* prefix);
     #define WOLFSSL_STUB(m)       WC_DO_NOTHING
     #define WOLFSSL_IS_DEBUG_ON() 0
 
-    #ifdef __WATCOMC__ /* does not allow variadic macros */
+    #ifdef WOLF_NO_VARIADIC_MACROS
+        /* note, modern preprocessors will generate errors with this definition.
+         * "error: macro "WOLFSSL_MSG_EX" passed 2 arguments, but takes just 0"
+         */
         #define WOLFSSL_MSG_EX()    WC_DO_NOTHING
     #else
         #define WOLFSSL_MSG_EX(...) WC_DO_NOTHING
@@ -229,8 +236,13 @@ WOLFSSL_API void wolfSSL_SetLoggingPrefix(const char* prefix);
     #ifdef WOLFSSL_HAVE_ERROR_QUEUE
         WOLFSSL_API void WOLFSSL_ERROR_LINE(int err, const char* func, unsigned int line,
             const char* file, void* ctx);
-        #define WOLFSSL_ERROR(x) \
-            WOLFSSL_ERROR_LINE((x), __func__, __LINE__, __FILE__, NULL)
+        #ifdef WOLF_C89
+            #define WOLFSSL_ERROR(x) \
+                WOLFSSL_ERROR_LINE((x), __FILE__, __LINE__, __FILE__, NULL)
+        #else
+            #define WOLFSSL_ERROR(x) \
+                WOLFSSL_ERROR_LINE((x), __func__, __LINE__, __FILE__, NULL)
+        #endif
     #else
         WOLFSSL_API void WOLFSSL_ERROR(int err);
     #endif /* WOLFSSL_HAVE_ERROR_QUEUE */
diff --git a/wolfssl/wolfcrypt/mem_track.h b/wolfssl/wolfcrypt/mem_track.h
index b45bf2388a..a69d1f01fd 100644
--- a/wolfssl/wolfcrypt/mem_track.h
+++ b/wolfssl/wolfcrypt/mem_track.h
@@ -157,9 +157,9 @@ static WC_INLINE void* TrackMalloc(size_t sz)
         return NULL;
 
 #ifdef FREERTOS
-    mt = (memoryTrack*)pvPortMalloc(sizeof(memoryTrack) + sz);
+    mt = (memoryTrack*)pvPortMalloc(sizeof(memoryTrack) + sz); /* native heap */
 #else
-    mt = (memoryTrack*)malloc(sizeof(memoryTrack) + sz);
+    mt = (memoryTrack*)malloc(sizeof(memoryTrack) + sz); /* native heap */
 #endif
     if (mt == NULL)
         return NULL;
@@ -300,9 +300,9 @@ static WC_INLINE void TrackFree(void* ptr)
     (void)sz;
 
 #ifdef FREERTOS
-    vPortFree(mt);
+    vPortFree(mt); /* native heap */
 #else
-    free(mt);
+    free(mt); /* native heap */
 #endif
 }
 
@@ -600,7 +600,7 @@ static WC_INLINE int StackSizeCheck(struct func_args* args, thread_func tf)
         stackSize = PTHREAD_STACK_MIN;
 #endif
 
-    ret = posix_memalign((void**)&myStack, sysconf(_SC_PAGESIZE), stackSize);
+    ret = posix_memalign((void**)&myStack, sysconf(_SC_PAGESIZE), stackSize); /* native heap */
     if (ret != 0 || myStack == NULL) {
         wc_mem_printf("posix_memalign failed\n");
         return -1;
@@ -650,7 +650,7 @@ static WC_INLINE int StackSizeCheck(struct func_args* args, thread_func tf)
         }
     }
 
-    free(myStack);
+    free(myStack); /* native heap */
 #ifdef HAVE_STACK_SIZE_VERBOSE
     printf("stack used = %lu\n", StackSizeCheck_stackSizeHWM > (stackSize - i)
         ? (unsigned long)StackSizeCheck_stackSizeHWM
@@ -681,16 +681,16 @@ static WC_INLINE int StackSizeCheck_launch(struct func_args* args,
         stackSize = PTHREAD_STACK_MIN;
 #endif
 
-    shim_args = (struct stack_size_debug_context *)malloc(sizeof *shim_args);
+    shim_args = (struct stack_size_debug_context *)malloc(sizeof *shim_args); /* native heap */
     if (shim_args == NULL) {
         perror("malloc");
         return -1;
     }
 
-    ret = posix_memalign((void**)&myStack, sysconf(_SC_PAGESIZE), stackSize);
+    ret = posix_memalign((void**)&myStack, sysconf(_SC_PAGESIZE), stackSize); /* native heap */
     if (ret != 0 || myStack == NULL) {
         wc_mem_printf("posix_memalign failed\n");
-        free(shim_args);
+        free(shim_args); /* native heap */
         return -1;
     }
 
@@ -699,8 +699,8 @@ static WC_INLINE int StackSizeCheck_launch(struct func_args* args,
     ret = pthread_attr_init(&myAttr);
     if (ret != 0) {
         wc_mem_printf("attr_init failed\n");
-        free(shim_args);
-        free(myStack);
+        free(shim_args); /* native heap */
+        free(myStack); /* native heap */
         return ret;
     }
 
@@ -749,7 +749,7 @@ static WC_INLINE int StackSizeCheck_reap(pthread_t threadId,
         }
     }
 
-    free(shim_args->myStack);
+    free(shim_args->myStack); /* native heap */
 #ifdef HAVE_STACK_SIZE_VERBOSE
     printf("stack used = %lu\n",
         *shim_args->stackSizeHWM_ptr > (shim_args->stackSize - i)
@@ -761,7 +761,7 @@ static WC_INLINE int StackSizeCheck_reap(pthread_t threadId,
       printf("stack used = %lu\n", (unsigned long)used);
     }
 #endif
-    free(shim_args);
+    free(shim_args); /* native heap */
 
     return (int)((size_t)status);
 }
diff --git a/wolfssl/wolfcrypt/rsa.h b/wolfssl/wolfcrypt/rsa.h
index c51cad76b9..dc23839b7f 100644
--- a/wolfssl/wolfcrypt/rsa.h
+++ b/wolfssl/wolfcrypt/rsa.h
@@ -169,8 +169,12 @@ enum {
     RSA_PSS_SALT_MAX_SZ = 62,
 
 #ifdef OPENSSL_EXTRA
-    RSA_PKCS1_PADDING_SIZE = 11,
-    RSA_PKCS1_OAEP_PADDING_SIZE = 42, /* (2 * hashlen(SHA-1)) + 2 */
+    WC_RSA_PKCS1_PADDING_SIZE = 11,
+    WC_RSA_PKCS1_OAEP_PADDING_SIZE = 42, /* (2 * hashlen(SHA-1)) + 2 */
+    #ifndef OPENSSL_COEXIST
+        #define RSA_PKCS1_PADDING_SIZE WC_RSA_PKCS1_PADDING_SIZE
+        #define RSA_PKCS1_OAEP_PADDING_SIZE WC_RSA_PKCS1_OAEP_PADDING_SIZE
+    #endif
 #endif
 #ifdef WC_RSA_PSS
     RSA_PSS_PAD_TERM = 0xBC,
diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h
index 4db07866e5..9f5fa3401d 100644
--- a/wolfssl/wolfcrypt/settings.h
+++ b/wolfssl/wolfcrypt/settings.h
@@ -1425,9 +1425,9 @@ extern void uITRON4_free(void *p) ;
 #if defined(WOLFSSL_LEANPSK) && !defined(XMALLOC_USER) && \
         !defined(NO_WOLFSSL_MEMORY) && !defined(WOLFSSL_STATIC_MEMORY)
     #include <stdlib.h>
-    #define XMALLOC(s, h, type)  ((void)(h), (void)(type), malloc((s)))
-    #define XFREE(p, h, type)    ((void)(h), (void)(type), free((p)))
-    #define XREALLOC(p, n, h, t) ((void)(h), (void)(t), realloc((p), (n)))
+    #define XMALLOC(s, h, type)  ((void)(h), (void)(type), malloc((s))) /* native heap */
+    #define XFREE(p, h, type)    ((void)(h), (void)(type), free((p))) /* native heap */
+    #define XREALLOC(p, n, h, t) ((void)(h), (void)(t), realloc((p), (n))) /* native heap */
 #endif
 
 #if defined(XMALLOC_USER) && defined(SSN_BUILDING_LIBYASSL)
@@ -1462,18 +1462,18 @@ extern void uITRON4_free(void *p) ;
                            (s), (__FILE__), (__LINE__), (__FUNCTION__) ))
         #else
             #define XMALLOC(s, h, type)  \
-                           ((void)(h), (void)(type), pvPortMalloc((s)))
+                           ((void)(h), (void)(type), pvPortMalloc((s))) /* native heap */
         #endif
 
         /* XFREE */
-        #define XFREE(p, h, type)    ((void)(h), (void)(type), vPortFree((p)))
+        #define XFREE(p, h, type)    ((void)(h), (void)(type), vPortFree((p))) /* native heap */
 
         /* XREALLOC */
         #if defined(WOLFSSL_ESPIDF)
             /* In the Espressif EDP-IDF, realloc(p, n) is equivalent to
              *     heap_caps_realloc(p, s, MALLOC_CAP_8BIT)
              * There's no pvPortRealloc available:  */
-            #define XREALLOC(p, n, h, t) ((void)(h), (void)(t), realloc((p), (n)))
+            #define XREALLOC(p, n, h, t) ((void)(h), (void)(t), realloc((p), (n))) /* native heap */
         #elif defined(USE_INTEGER_HEAP_MATH) || defined(OPENSSL_EXTRA) || \
               defined(OPENSSL_ALL)
             /* FreeRTOS pvPortRealloc() implementation can be found here:
@@ -1515,8 +1515,8 @@ extern void uITRON4_free(void *p) ;
 #ifdef FREERTOS_TCP
     #if !defined(NO_WOLFSSL_MEMORY) && !defined(XMALLOC_USER) && \
         !defined(WOLFSSL_STATIC_MEMORY)
-        #define XMALLOC(s, h, type)  pvPortMalloc((s))
-        #define XFREE(p, h, type)    vPortFree((p))
+        #define XMALLOC(s, h, type)  pvPortMalloc((s)) /* native heap */
+        #define XFREE(p, h, type)    vPortFree((p)) /* native heap */
     #endif
 
     #define WOLFSSL_GENSEED_FORTEST
@@ -1684,8 +1684,8 @@ extern void uITRON4_free(void *p) ;
     #endif
     #if !defined(XMALLOC_USER) && !defined(NO_WOLFSSL_MEMORY) && \
         !defined(WOLFSSL_STATIC_MEMORY)
-        #define XMALLOC(s, h, type)  ((void)(h), (void)(type), pvPortMalloc((s)))
-        #define XFREE(p, h, type)    ((void)(h), (void)(type), vPortFree((p)))
+        #define XMALLOC(s, h, type)  ((void)(h), (void)(type), pvPortMalloc((s))) /* native heap */
+        #define XFREE(p, h, type)    ((void)(h), (void)(type), vPortFree((p))) /* native heap */
 
         /* FreeRTOS pvPortRealloc() implementation can be found here:
             https://github.com/wolfSSL/wolfssl-freertos/pull/3/files */
@@ -1803,8 +1803,8 @@ extern void uITRON4_free(void *p) ;
     #define WOLFSSL_CRYPT_HW_MUTEX 1
 
     #if !defined(XMALLOC_USER) && !defined(NO_WOLFSSL_MEMORY)
-        #define XMALLOC(s, h, type)  ((void)(h), (void)(type), pvPortMalloc((s)))
-        #define XFREE(p, h, type)    ((void)(h), (void)(type), vPortFree((p)))
+        #define XMALLOC(s, h, type)  ((void)(h), (void)(type), pvPortMalloc((s))) /* native heap */
+        #define XFREE(p, h, type)    ((void)(h), (void)(type), vPortFree((p))) /* native heap */
     #endif
 
     /* #define USER_TICKS */
@@ -2753,6 +2753,10 @@ extern void uITRON4_free(void *p) ;
     #define WOLFSSL_SP_NO_DYN_STACK
 #endif
 
+#if defined(__WATCOMC__) && !defined(WOLF_NO_VARIADIC_MACROS)
+    #define WOLF_NO_VARIADIC_MACROS
+#endif
+
 #ifdef __INTEL_COMPILER
     #pragma warning(disable:2259) /* explicit casts to smaller sizes, disable */
 #endif
diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h
index e889a6e204..e2dd969d8a 100644
--- a/wolfssl/wolfcrypt/types.h
+++ b/wolfssl/wolfcrypt/types.h
@@ -113,7 +113,11 @@ decouple library dependencies with standard string, memory and so on.
     #endif
 
     #ifndef WC_BITFIELD
-        #define WC_BITFIELD byte
+        #ifdef WOLF_C89
+            #define WC_BITFIELD unsigned
+        #else
+            #define WC_BITFIELD byte
+        #endif
     #endif
 
     #ifndef HAVE_ANONYMOUS_INLINE_AGGREGATES
@@ -130,24 +134,27 @@ decouple library dependencies with standard string, memory and so on.
         #endif
     #endif
 
+    /* helpers for stringifying the expanded value of a macro argument rather
+     * than its literal text:
+     */
+    #define _WC_STRINGIFY_L2(str) #str
+    #define WC_STRINGIFY(str) _WC_STRINGIFY_L2(str)
+
     /* With a true C89-dialect compiler (simulate with gcc -std=c89 -Wall
      * -Wextra -pedantic), a trailing comma on the last value in an enum
      * definition is a syntax error.  We use this macro to accommodate that
      * without disrupting clean flow/syntax when some enum values are
      * preprocessor-gated.
      */
+    #define WC_VALUE_OF(x) x
     #if defined(WOLF_C89) || defined(WOLF_NO_TRAILING_ENUM_COMMAS)
-        #define WOLF_ENUM_DUMMY_LAST_ELEMENT(prefix) _wolf_ ## prefix ## _enum_dummy_last_element
+        #define _WOLF_ENUM_DUMMY_LAST_ELEMENT_HELPER2(a, b, c, d, e) a ## b ## c ## d ## e
+        #define _WOLF_ENUM_DUMMY_LAST_ELEMENT_HELPER(a, b, c, d, e) _WOLF_ENUM_DUMMY_LAST_ELEMENT_HELPER2(a, b, c, d, e)
+        #define WOLF_ENUM_DUMMY_LAST_ELEMENT(prefix) _WOLF_ENUM_DUMMY_LAST_ELEMENT_HELPER(_wolf_, prefix, _L, __LINE__, _enum_dummy_last_element)
     #else
         #define WOLF_ENUM_DUMMY_LAST_ELEMENT(prefix) /* null expansion */
     #endif
 
-    /* helpers for stringifying the expanded value of a macro argument rather
-     * than its literal text:
-     */
-    #define _WC_STRINGIFY_L2(str) #str
-    #define WC_STRINGIFY(str) _WC_STRINGIFY_L2(str)
-
     /* try to set SIZEOF_LONG or SIZEOF_LONG_LONG if user didn't */
     #if defined(_WIN32) || defined(HAVE_LIMITS_H)
         /* make sure both SIZEOF_LONG_LONG and SIZEOF_LONG are set,
@@ -438,16 +445,6 @@ typedef struct w64wrapper {
     #define WC_SAFE_SUM_WORD32(in1, in2, out) ((in2) <= 0xffffffffU - (in1) ? \
                 ((out) = (in1) + (in2), 1) : ((out) = 0xffffffffU, 0))
 
-    /* idea to add global alloc override by Moises Guimaraes  */
-    /* default to libc stuff */
-    /* XREALLOC is used once in normal math lib, not in fast math lib */
-    /* XFREE on some embedded systems doesn't like free(0) so test for NULL
-     * explicitly.
-     *
-     * For example:
-     *   #define XFREE(p, h, t) \
-     *      {void* xp = (p); if (xp != NULL) free(xp, h, t);}
-     */
     #if defined(HAVE_IO_POOL)
         WOLFSSL_API void* XMALLOC(size_t n, void* heap, int type);
         WOLFSSL_API void* XREALLOC(void *p, size_t n, void* heap, int type);
@@ -540,14 +537,14 @@ typedef struct w64wrapper {
         #else
             /* just use plain C stdlib stuff if desired */
             #include <stdlib.h>
-            #define XMALLOC(s, h, t)     ((void)(h), (void)(t), malloc((size_t)(s)))
+            #define XMALLOC(s, h, t)     ((void)(h), (void)(t), malloc((size_t)(s))) /* native heap */
             #ifdef WOLFSSL_XFREE_NO_NULLNESS_CHECK
-                #define XFREE(p, h, t)       do { (void)(h); (void)(t); free(p); } while (0)
+                #define XFREE(p, h, t)       do { (void)(h); (void)(t); free(p); } while (0) /* native heap */
             #else
-                #define XFREE(p, h, t)       do { void* xp = (p); (void)(h); if (xp) free(xp); } while (0)
+                #define XFREE(p, h, t)       do { void* xp = (p); (void)(h); if (xp) free(xp); } while (0) /* native heap */
             #endif
             #define XREALLOC(p, n, h, t) \
-                ((void)(h), (void)(t), realloc((p), (size_t)(n)))
+                ((void)(h), (void)(t), realloc((p), (size_t)(n))) /* native heap */
         #endif
 
     #elif defined(WOLFSSL_LINUXKM)
@@ -862,7 +859,11 @@ typedef struct w64wrapper {
                 #endif
                 #define XSPRINTF sprintf
                 /* snprintf not available for C89, so remap using macro */
-                #define XSNPRINTF(f, len, ...) sprintf(f, __VA_ARGS__)
+                #ifdef WOLF_NO_VARIADIC_MACROS
+                    #error WOLF_NO_VARIADIC_MACROS requires user-supplied binding for XSNPRINTF
+                #else
+                    #define XSNPRINTF(f, len, ...) sprintf(f, __VA_ARGS__)
+                #endif
             #else
                 #ifndef NO_STDIO_FILESYSTEM
                 #include <stdio.h>
@@ -1107,6 +1108,7 @@ typedef struct w64wrapper {
         DYNAMIC_TYPE_LMS          = 101,
         DYNAMIC_TYPE_BIO          = 102,
         DYNAMIC_TYPE_X509_ACERT   = 103,
+        DYNAMIC_TYPE_OS_BUF       = 104,
         DYNAMIC_TYPE_SNIFFER_SERVER       = 1000,
         DYNAMIC_TYPE_SNIFFER_SESSION      = 1001,
         DYNAMIC_TYPE_SNIFFER_PB           = 1002,