diff --git a/src/runtime_src/core/edge/drm/zocl/edge/zocl_hwctx.c b/src/runtime_src/core/edge/drm/zocl/edge/zocl_hwctx.c
index ebcb66d4727..701af6cf3e7 100644
--- a/src/runtime_src/core/edge/drm/zocl/edge/zocl_hwctx.c
+++ b/src/runtime_src/core/edge/drm/zocl/edge/zocl_hwctx.c
@@ -98,14 +98,20 @@ static int zocl_cu_ctx_to_info(struct drm_zocl_dev *zdev, struct drm_zocl_open_c
 {
     uint32_t slot_hndl = kds_hw_ctx->slot_idx;
     struct kds_sched *kds = &zdev->kds;
-    char *kname_p = drm_cu_ctx->cu_name;
+    char name[CU_NAME_MAX_LEN + 1];
+    char *kname_p = name;
+    char *token;
     struct xrt_cu *xcu = NULL;
     char iname[CU_NAME_MAX_LEN];
     char kname[CU_NAME_MAX_LEN];
     int i = 0;
 
-    strcpy(kname, strsep(&kname_p, ":"));
-    strcpy(iname, strsep(&kname_p, ":"));
+    memcpy(name, drm_cu_ctx->cu_name, CU_NAME_MAX_LEN);
+    name[CU_NAME_MAX_LEN] = '\0';
+    token = strsep(&kname_p, ":");
+    strscpy(kname, token ? token : "", sizeof(kname));
+    token = strsep(&kname_p, ":");
+    strscpy(iname, token ? token : "", sizeof(iname));
 
     /* Retrive the CU index from the given slot */
     for (i = 0; i < MAX_CUS; i++) {
diff --git a/src/runtime_src/core/edge/drm/zocl/zert/zocl_ctrl_ert.c b/src/runtime_src/core/edge/drm/zocl/zert/zocl_ctrl_ert.c
index a18bf443387..931d7c99635 100644
--- a/src/runtime_src/core/edge/drm/zocl/zert/zocl_ctrl_ert.c
+++ b/src/runtime_src/core/edge/drm/zocl/zert/zocl_ctrl_ert.c
@@ -158,7 +158,12 @@ static inline u32 reg_read(void __iomem *base, u64 off)
 
 static void cu_conf2info(struct xgq_cmd_config_cu *conf, struct xrt_cu_info *info)
 {
-	char *kname_p = conf->name;
+	char name[sizeof(conf->name) + 1];
+	char *kname_p = name;
+	char *token;
+
+	memcpy(name, conf->name, sizeof(conf->name));
+	name[sizeof(conf->name)] = 0;
 
 	memset(info, 0, sizeof(*info));
 	info->num_res = 1;
@@ -176,8 +181,10 @@ static void cu_conf2info(struct xgq_cmd_config_cu *conf, struct xrt_cu_info *inf
 		info->model = XCU_HLS;
 	info->cu_domain = conf->cu_domain;
 	info->cu_idx = conf->cu_idx;
-	strcpy(info->kname, strsep(&kname_p, ":"));
-	strcpy(info->iname, strsep(&kname_p, ":"));
+	token = strsep(&kname_p, ":");
+	strscpy(info->kname, token ? token : "", sizeof(info->kname));
+	token = strsep(&kname_p, ":");
+	strscpy(info->iname, token ? token : "", sizeof(info->iname));
 	memcpy(info->uuid, conf->uuid, sizeof(info->uuid));
 }
 
diff --git a/src/runtime_src/core/pcie/driver/linux/xocl/subdev/ert_ctrl.c b/src/runtime_src/core/pcie/driver/linux/xocl/subdev/ert_ctrl.c
index ac3bb51add2..b21574e3647 100644
--- a/src/runtime_src/core/pcie/driver/linux/xocl/subdev/ert_ctrl.c
+++ b/src/runtime_src/core/pcie/driver/linux/xocl/subdev/ert_ctrl.c
@@ -493,6 +493,45 @@ static void ert_ctrl_submit_exit_cmd(struct ert_ctrl *ec)
 
 static bool ert_ctrl_abort_sync(struct kds_ert *ert, struct kds_client *client, int cu_idx)
 {
+	struct kds_client_hw_ctx *hw_ctx;
+	unsigned long submitted = 0, completed = 0;
+	int timeout_ms = 5000;
+
+	/* Sum submitted and completed counts across all hw contexts */
+	list_for_each_entry(hw_ctx, &client->hw_ctx_list, link) {
+		int i;
+
+		for (i = 0; i < MAX_CUS; i++) {
+			submitted += stat_read(hw_ctx->stats, s_cnt[i]);
+			submitted += stat_read(hw_ctx->stats, scu_s_cnt[i]);
+			completed += stat_read(hw_ctx->stats, c_cnt[i]);
+			completed += stat_read(hw_ctx->stats, scu_c_cnt[i]);
+		}
+	}
+
+	if (submitted == completed)
+		return false;
+
+	/* Wait for in-flight commands to drain before client is freed */
+	do {
+		msleep(500);
+		timeout_ms -= 500;
+		submitted = 0;
+		completed = 0;
+		list_for_each_entry(hw_ctx, &client->hw_ctx_list, link) {
+			int i;
+
+			for (i = 0; i < MAX_CUS; i++) {
+				submitted += stat_read(hw_ctx->stats, s_cnt[i]);
+				submitted += stat_read(hw_ctx->stats, scu_s_cnt[i]);
+				completed += stat_read(hw_ctx->stats, c_cnt[i]);
+				completed += stat_read(hw_ctx->stats, scu_c_cnt[i]);
+			}
+		}
+		if (submitted == completed)
+			return false;
+	} while (timeout_ms > 0);
+
 	return true;
 }
 
diff --git a/src/runtime_src/core/pcie/driver/linux/xocl/userpf/xocl_bo.c b/src/runtime_src/core/pcie/driver/linux/xocl/userpf/xocl_bo.c
index da8a890c785..82ea0cd30c6 100644
--- a/src/runtime_src/core/pcie/driver/linux/xocl/userpf/xocl_bo.c
+++ b/src/runtime_src/core/pcie/driver/linux/xocl/userpf/xocl_bo.c
@@ -1470,7 +1470,7 @@ static bool xocl_validate_paddr(struct xocl_dev *xdev, u64 paddr, u64 size)
 #endif
 
 int xocl_pwrite_unmgd_ioctl(struct drm_device *dev, void *data,
-			    struct drm_file *filp)
+		    struct drm_file *filp)
 {
 	const struct drm_xocl_pwrite_unmgd *args = data;
 	struct xocl_drm *drm_p = dev->dev_private;
@@ -1482,27 +1482,19 @@ int xocl_pwrite_unmgd_ioctl(struct drm_device *dev, void *data,
 		return -EFAULT;
 	}
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	if (args->size == 0)
 		return 0;
 
-	/* currently we are not able to return error because
-	 * it is unclear that what addresses are valid other than
-	 * ddr area. we should revisit this sometime.
-	 * if (!xocl_validate_paddr(xdev, args->paddr, args->size)) {
-	 *	userpf_err(xdev, "invalid paddr: 0x%llx, size:0x%llx",
-	 *		args->paddr, args->size);
-	 *	return -EINVAL;
-	 * }
-	 */
-
-
 	ret = xocl_migrate_unmgd(xdev, args->data_ptr, args->paddr, args->size, 1);
 
 	return ret;
 }
 
 int xocl_pread_unmgd_ioctl(struct drm_device *dev, void *data,
-			   struct drm_file *filp)
+		   struct drm_file *filp)
 {
 	const struct drm_xocl_pwrite_unmgd *args = data;
 	struct xocl_drm *drm_p = dev->dev_private;
@@ -1514,19 +1506,12 @@ int xocl_pread_unmgd_ioctl(struct drm_device *dev, void *data,
 		return -EFAULT;
 	}
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	if (args->size == 0)
 		return 0;
 
-	/* currently we are not able to return error because
-	 * it is unclear that what addresses are valid other than
-	 * ddr area. we should revisit this sometime.
-	 * if (!xocl_validate_paddr(xdev, args->paddr, args->size)) {
-	 *	userpf_err(xdev, "invalid paddr: 0x%llx, size:0x%llx",
-	 *		args->paddr, args->size);
-	 *	return -EINVAL;
-	 * }
-	 */
-
 	ret = xocl_migrate_unmgd(xdev, args->data_ptr, args->paddr, args->size, 0);
 
 	return ret;
diff --git a/src/runtime_src/core/pcie/driver/linux/xocl/userpf/xocl_hwctx.c b/src/runtime_src/core/pcie/driver/linux/xocl/userpf/xocl_hwctx.c
index 2537f6c0c3b..40be4406d8f 100644
--- a/src/runtime_src/core/pcie/driver/linux/xocl/userpf/xocl_hwctx.c
+++ b/src/runtime_src/core/pcie/driver/linux/xocl/userpf/xocl_hwctx.c
@@ -109,14 +109,20 @@ xocl_cu_ctx_to_info(struct xocl_dev *xdev, struct drm_xocl_open_cu_ctx *cu_args,
 {
         uint32_t slot_hndl = hw_ctx->slot_idx;
         struct kds_sched *kds = &XDEV(xdev)->kds;
-        char *kname_p = cu_args->cu_name;
+        char name[CU_NAME_MAX_LEN + 1];
+        char *kname_p = name;
+        char *token;
         struct xrt_cu *xcu = NULL;
         char iname[CU_NAME_MAX_LEN];
         char kname[CU_NAME_MAX_LEN];
         int i = 0;
 
-        strcpy(kname, strsep(&kname_p, ":"));
-        strcpy(iname, strsep(&kname_p, ":"));
+        memcpy(name, cu_args->cu_name, CU_NAME_MAX_LEN);
+        name[CU_NAME_MAX_LEN] = '\0';
+        token = strsep(&kname_p, ":");
+        strscpy(kname, token ? token : "", sizeof(kname));
+        token = strsep(&kname_p, ":");
+        strscpy(iname, token ? token : "", sizeof(iname));
 
         /* Retrieve the CU index from the given slot */
         for (i = 0; i < MAX_CUS; i++) {