diff --git a/bta/av/bta_av_act.cc b/bta/av/bta_av_act.cc
index 1e27c25..67a8299 100644
--- a/bta/av/bta_av_act.cc
+++ b/bta/av/bta_av_act.cc
@@ -1788,6 +1788,23 @@
       peer_features |=
           bta_av_check_peer_features(UUID_SERVCLASS_AV_REM_CTRL_TARGET);
     }
+
+    /* Change our features if the remote AVRCP version is 1.3 or less */
+    tSDP_DISC_REC* p_rec = nullptr;
+    p_rec = SDP_FindServiceInDb(p_cb->p_disc_db,
+                                UUID_SERVCLASS_AV_REMOTE_CONTROL, p_rec);
+    if (p_rec != NULL &&
+        SDP_FindAttributeInRec(p_rec, ATTR_ID_BT_PROFILE_DESC_LIST) != NULL) {
+      /* get profile version (if failure, version parameter is not updated) */
+      uint16_t peer_rc_version = 0xFFFF;  // Don't change the AVRCP version
+      SDP_FindProfileVersionInRec(p_rec, UUID_SERVCLASS_AV_REMOTE_CONTROL,
+                                  &peer_rc_version);
+      if (peer_rc_version <= AVRC_REV_1_3) {
+        APPL_TRACE_DEBUG("%s Using AVRCP 1.3 Capabilities with remote device",
+                         __func__);
+        p_bta_av_cfg = (tBTA_AV_CFG*)&bta_av_cfg_compatibility;
+      }
+    }
   }
 
   p_cb->disc = 0;
diff --git a/bta/gatt/bta_gatts_act.cc b/bta/gatt/bta_gatts_act.cc
index 86dfd9a..15b48db 100644
--- a/bta/gatt/bta_gatts_act.cc
+++ b/bta/gatt/bta_gatts_act.cc
@@ -305,7 +305,7 @@
   tBTA_GATTS cb_data;
 
   cb_data.srvc_oper.server_if = p_rcb->gatt_if;
-  // cb_data.srvc_oper.service_id = p_msg->api_add_incl_srvc.hdr.layer_specific;
+  cb_data.srvc_oper.service_id = p_srvc_cb->service_id;
 
   if (GATTS_DeleteService(p_rcb->gatt_if, &p_srvc_cb->service_uuid,
                           p_srvc_cb->service_id)) {
diff --git a/btif/src/btif_sdp_server.cc b/btif/src/btif_sdp_server.cc
index 43d489b..b84d694 100644
--- a/btif/src/btif_sdp_server.cc
+++ b/btif/src/btif_sdp_server.cc
@@ -214,7 +214,8 @@
 static int free_sdp_slot(int id) {
   int handle = -1;
   bluetooth_sdp_record* record = NULL;
-  if (id >= MAX_SDP_SLOTS) {
+  if (id < 0 || id >= MAX_SDP_SLOTS) {
+    android_errorWriteLog(0x534e4554, "37502513");
     APPL_TRACE_ERROR("%s() failed - id %d is invalid", __func__, id);
     return handle;
   }
diff --git a/stack/gap/gap_conn.cc b/stack/gap/gap_conn.cc
index c51363b..fcc2161 100644
--- a/stack/gap/gap_conn.cc
+++ b/stack/gap/gap_conn.cc
@@ -142,6 +142,9 @@
   /* update the transport */
   p_ccb->transport = transport;
 
+  /* The service_id must be set before calling gap_release_ccb(). */
+  p_ccb->service_id = service_id;
+
   /* If caller specified a BD address, save it */
   if (p_rem_bda) {
     /* the bd addr is not BT_BD_ANY, then a bd address was specified */
@@ -211,7 +214,6 @@
   }
 
   /* Register with Security Manager for the specific security level */
-  p_ccb->service_id = service_id;
   if (!BTM_SetSecurityLevel((uint8_t)!is_server, p_serv_name, p_ccb->service_id,
                             security, p_ccb->psm, 0, 0)) {
     GAP_TRACE_ERROR("GAP_CONN - Security Error");
diff --git a/test/suite/gatt/gatt_unittest.cc b/test/suite/gatt/gatt_unittest.cc
index 598ae41..c216d6e 100644
--- a/test/suite/gatt/gatt_unittest.cc
+++ b/test/suite/gatt/gatt_unittest.cc
@@ -98,16 +98,24 @@
   gatt_server_interface()->add_service(server_if, service);
   semaphore_wait(service_added_callback_sem_);
   EXPECT_TRUE(status() == BT_STATUS_SUCCESS) << "Error adding service.";
+  EXPECT_TRUE(server_interface_id() == server_if) << "Wrong server_if added.";
+  int service_handle_added = service_handle();
 
   // Stops server.
   gatt_server_interface()->stop_service(server_if, service_handle());
   semaphore_wait(service_stopped_callback_sem_);
   EXPECT_TRUE(status() == BT_STATUS_SUCCESS) << "Error stopping server.";
+  EXPECT_TRUE(service_handle() == service_handle_added)
+      << "Wrong service handle stopped.";
+  EXPECT_TRUE(server_interface_id() == server_if) << "Wrong server_if stopped.";
 
   // Deletes service.
   gatt_server_interface()->delete_service(server_if, service_handle());
   semaphore_wait(service_deleted_callback_sem_);
   EXPECT_TRUE(status() == BT_STATUS_SUCCESS) << "Error deleting service.";
+  EXPECT_TRUE(service_handle() == service_handle_added)
+      << "Wrong service handle deleted.";
+  EXPECT_TRUE(server_interface_id() == server_if) << "Wrong server_if deleted.";
 
   // Unregisters gatt server. No callback is expected.
   gatt_server_interface()->unregister_server(server_if);