diff --git a/dtls/client-dtls-cid.c b/dtls/client-dtls-cid.c
index 9888840ab..d76106f88 100644
--- a/dtls/client-dtls-cid.c
+++ b/dtls/client-dtls-cid.c
@@ -141,10 +141,11 @@ int main (int argc, char** argv)
                 printf("wolfSSL_read failed");
             }
         }
-
-        /* Add a terminating character to the generic server message */
-        recvLine[n] = '\0';
-        fputs(recvLine, stdout);
+        else {
+            /* Add a terminating character to the generic server message */
+            recvLine[n] = '\0';
+            fputs(recvLine, stdout);
+        }
 
         close(sockfd);
         if ( (sockfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
diff --git a/embedded/tls-info.h b/embedded/tls-info.h
index 559299947..20f9821ec 100644
--- a/embedded/tls-info.h
+++ b/embedded/tls-info.h
@@ -101,13 +101,22 @@ static WC_INLINE void ShowX509Ex(WOLFSSL_X509* x509, const char* hdr,
     if (ret == WOLFSSL_SUCCESS) {
         int  i;
         int  strLen;
-        char serialMsg[80];
+        /* worst case: header string + ":xx " (3 chars stride) per serial
+           byte + null terminator */
+        char serialMsg[64 + sizeof(serial) * 3 + 1];
 
         /* testsuite has multiple threads writing to stdout, get output
            message ready to write once */
-        strLen = sprintf(serialMsg, " %s", words[3]);
-        for (i = 0; i < sz; i++)
-            sprintf(serialMsg + strLen + (i*3), ":%02x ", serial[i]);
+        strLen = snprintf(serialMsg, sizeof(serialMsg), " %s", words[3]);
+        if (strLen < 0)
+            strLen = 0;
+        for (i = 0; i < sz; i++) {
+            int remaining = (int)sizeof(serialMsg) - strLen - (i * 3);
+            if (remaining <= 0)
+                break;
+            snprintf(serialMsg + strLen + (i * 3), (size_t)remaining,
+                    ":%02x ", serial[i]);
+        }
         printf("%s\n", serialMsg);
     }
 
diff --git a/tls/client-tls-cacb.c b/tls/client-tls-cacb.c
index 91dc2d1e0..55a03875a 100644
--- a/tls/client-tls-cacb.c
+++ b/tls/client-tls-cacb.c
@@ -100,13 +100,22 @@ static void CaCb(unsigned char* der, int sz, int type)
         if (ret == WOLFSSL_SUCCESS) {
             int  i;
             int  strLen;
-            char serialMsg[80];
+            /* worst case: header string + ":xx " (3 chars stride) per serial
+               byte + null terminator */
+            char serialMsg[64 + sizeof(serial) * 3 + 1];
 
             /* testsuite has multiple threads writing to stdout, get output
                message ready to write once */
-            strLen = sprintf(serialMsg, "\tSerial Number");
-            for (i = 0; i < sz; i++)
-                sprintf(serialMsg + strLen + (i*3), ":%02x ", serial[i]);
+            strLen = snprintf(serialMsg, sizeof(serialMsg), "\tSerial Number");
+            if (strLen < 0)
+                strLen = 0;
+            for (i = 0; i < sz; i++) {
+                int remaining = (int)sizeof(serialMsg) - strLen - (i * 3);
+                if (remaining <= 0)
+                    break;
+                snprintf(serialMsg + strLen + (i * 3), (size_t)remaining,
+                        ":%02x ", serial[i]);
+            }
             printf("%s\n", serialMsg);
         }
 
diff --git a/tls/memory-tls.c b/tls/memory-tls.c
index 663ac8551..4ac7e1c49 100644
--- a/tls/memory-tls.c
+++ b/tls/memory-tls.c
@@ -153,7 +153,7 @@ static void* client_thread(void* args)
     wolfSSL_SetIORecv(cli_ctx, ClientRecv);
 
     WOLFSSL* cli_ssl = wolfSSL_new(cli_ctx);
-    if (cli_ctx == NULL) err_sys("bad client new");
+    if (cli_ssl == NULL) err_sys("bad client new");
 
     ret = wolfSSL_connect(cli_ssl);
     if (ret != WOLFSSL_SUCCESS) err_sys("bad client tls connect");
@@ -185,7 +185,7 @@ int main()
     wolfSSL_SetIORecv(srv_ctx, ServerRecv);
 
     WOLFSSL* srv_ssl = wolfSSL_new(srv_ctx);
-    if (srv_ctx == NULL) err_sys("bad server new");
+    if (srv_ssl == NULL) err_sys("bad server new");
 
     /* start client thread */
     pthread_t tid;