Fix crash in reader mode.

The connect callback wasn't cleared in error cases,
which could cause spurious callbacks including data
that used to be allocated on the stack, and has been
freed by now.

Also, always add the -3a tech for any IsoDep target,
even if the remote device has the P2P bit set.

Bug: 10360259
Change-Id: I73141c4a1106f66ff89c6b1c53c4977e9cb78fa1
diff --git a/src/phHal4Nfc_ADD.c b/src/phHal4Nfc_ADD.c
index 727b7c4..d2040ea 100644
--- a/src/phHal4Nfc_ADD.c
+++ b/src/phHal4Nfc_ADD.c
@@ -493,13 +493,10 @@
                             Count++;
                         }
                     }
-                    if ( !(Sak & NFCIP_BITMASK) )
-                    {
-                        // Always add a separate 3A target on a separate
-                        // handle, so the upper layers can connect to it.
-                        aRemoteDevTypes[Count] = phHal_eISO14443_3A_PICC;
-                        Count++;
-                    }
+                    // Always add a separate 3A target on a separate
+                    // handle, so the upper layers can connect to it.
+                    aRemoteDevTypes[Count] = phHal_eISO14443_3A_PICC;
+                    Count++;
                 }
                 /*Check for P2P target passive*/
                 if((Sak & NFCIP_BITMASK) && 
diff --git a/src/phHal4Nfc_Reader.c b/src/phHal4Nfc_Reader.c
index f27bb09..526d0fc 100644
--- a/src/phHal4Nfc_Reader.c
+++ b/src/phHal4Nfc_Reader.c
@@ -237,6 +237,11 @@
         }
 
     }
+    if(NFCSTATUS_PENDING != RetStatus)
+    {
+        Hal4Ctxt->sUpperLayerInfo.psUpperLayerCtxt = NULL;
+        Hal4Ctxt->sTgtConnectInfo.pUpperConnectCb = NULL;
+    }
     return RetStatus;
 }