diff --git a/.github/workflows/test-build-riscv.yml b/.github/workflows/test-build-riscv.yml
index cbc11f6e..5b13443c 100644
--- a/.github/workflows/test-build-riscv.yml
+++ b/.github/workflows/test-build-riscv.yml
@@ -80,23 +80,22 @@ jobs:
         run: sudo apt-get update -o Acquire::Retries=3
 
       # ============================================================
-      # Prebuilt RISC-V toolchains from riscv-collab
-      # https://github.com/riscv-collab/riscv-gnu-toolchain/releases
-      # Extracts to: riscv/bin/riscv{32,64}-unknown-elf-*
+      # xPack RISC-V GCC — single toolchain with full multilib
+      # supporting both rv32 and rv64 targets (including rv32imac/ilp32
+      # and rv64imac/lp64 which riscv-collab nightly builds lack).
+      # https://github.com/xpack-dev-tools/riscv-none-elf-gcc-xpack
       # ============================================================
-      - name: Download and install RISC-V toolchain (riscv32)
-        if: ${{ inputs.arch == 'riscv' }}
+      - name: Download and install xPack RISC-V toolchain
         run: |
-          wget -q https://github.com/riscv-collab/riscv-gnu-toolchain/releases/latest/download/riscv32-elf-ubuntu-24.04-gcc.tar.xz
-          tar -xf riscv32-elf-ubuntu-24.04-gcc.tar.xz
-          echo "$GITHUB_WORKSPACE/riscv/bin" >> $GITHUB_PATH
-          $GITHUB_WORKSPACE/riscv/bin/riscv32-unknown-elf-gcc --version
-
-      - name: Install RISC-V toolchain (riscv64)
-        if: ${{ inputs.arch == 'riscv64' }}
-        run: |
-          sudo apt-get install -y gcc-riscv64-unknown-elf binutils-riscv64-unknown-elf
-          riscv64-unknown-elf-gcc --version
+          XPACK_VER="15.2.0-1"
+          XPACK_FILE="xpack-riscv-none-elf-gcc-${XPACK_VER}-linux-x64.tar.gz"
+          wget -q "https://github.com/xpack-dev-tools/riscv-none-elf-gcc-xpack/releases/download/v${XPACK_VER}/${XPACK_FILE}"
+          echo "aaaa8060c914851a3e5ee1ba82cc3d6f80972f90638a05c6e823a37557a33758  ${XPACK_FILE}" | sha256sum -c -
+          tar -xf "${XPACK_FILE}"
+          echo "$GITHUB_WORKSPACE/xpack-riscv-none-elf-gcc-${XPACK_VER}/bin" >> $GITHUB_PATH
+          export PATH="$GITHUB_WORKSPACE/xpack-riscv-none-elf-gcc-${XPACK_VER}/bin:$PATH"
+          riscv-none-elf-gcc --version
+          riscv-none-elf-gcc -print-multi-lib | head -5
 
       # ============================================================
       # Build wolfboot
@@ -116,9 +115,9 @@ jobs:
       - name: Build wolfboot (riscv32)
         if: ${{ inputs.arch == 'riscv' }}
         run: |
-          make CROSS_COMPILE=riscv32-unknown-elf- FREEDOM_E_SDK=$GITHUB_WORKSPACE/freedom-e-sdk ${{inputs.make-args}}
+          make CROSS_COMPILE=riscv-none-elf- FREEDOM_E_SDK=$GITHUB_WORKSPACE/freedom-e-sdk ${{inputs.make-args}}
 
       - name: Build wolfboot (riscv64)
         if: ${{ inputs.arch == 'riscv64' }}
         run: |
-          make CROSS_COMPILE=riscv64-unknown-elf- ${{inputs.make-args}}
+          make CROSS_COMPILE=riscv-none-elf- ${{inputs.make-args}}
diff --git a/hal/mpfs250-m.ld b/hal/mpfs250-m.ld
index 11d6f033..90f4814d 100644
--- a/hal/mpfs250-m.ld
+++ b/hal/mpfs250-m.ld
@@ -89,7 +89,7 @@ SECTIONS
         /* Public key store - must be in a copied section so it's available
          * in L2 SRAM after startup copies .data from eNVM */
         KEEP(*(.keystore*))
-        . = ALIGN(4);
+        . = ALIGN(8);
         _end_data = .;
     } > L2_SCRATCH AT > FLASH_ENVM
 
@@ -100,7 +100,7 @@ SECTIONS
         *(.bss*)
         *(.sbss*)
         *(COMMON)
-        . = ALIGN(4);
+        . = ALIGN(8);
         _end_bss = .;
         _end = .;
     } > L2_SCRATCH
diff --git a/hal/mpfs250.c b/hal/mpfs250.c
index 781daf8d..c808eeed 100644
--- a/hal/mpfs250.c
+++ b/hal/mpfs250.c
@@ -222,7 +222,7 @@ int mpfs_read_serial_number(uint8_t *serial)
     SCBCTRL_REG(SERVICES_CR_OFFSET) = cmd;
 
     /* Wait for request bit to clear (command accepted) */
-    timeout = 10000;
+    timeout = MPFS_SCB_TIMEOUT;
     while ((SCBCTRL_REG(SERVICES_CR_OFFSET) & SERVICES_CR_REQ_MASK) && timeout > 0) {
         timeout--;
     }
@@ -232,7 +232,7 @@ int mpfs_read_serial_number(uint8_t *serial)
     }
 
     /* Wait for busy bit to clear (command completed) */
-    timeout = 10000;
+    timeout = MPFS_SCB_TIMEOUT;
     while (mpfs_scb_mailbox_busy() && timeout > 0) {
         timeout--;
     }
@@ -1268,6 +1268,8 @@ static void uart_config_baud(unsigned long base, uint32_t baudrate)
     uint32_t div_int  = div_x64 / 64u;
     uint32_t div_frac = div_x64 - (div_int * 64u);
     div_frac += (div_x128 - (div_int * 128u)) - (div_frac * 2u);
+    if (div_frac > 63u)
+        div_frac = 63u;
     if (div_int > (uint32_t)UINT16_MAX)
         return;
     MMUART_LCR(base) |= DLAB_MASK;
diff --git a/hal/mpfs250.h b/hal/mpfs250.h
index 54aaa5ea..497bee4a 100644
--- a/hal/mpfs250.h
+++ b/hal/mpfs250.h
@@ -295,8 +295,8 @@ typedef struct {
     volatile uint32_t shared_mem_marker; /* 0x08: Init marker */
     volatile uint32_t shared_mem_status; /* 0x0C: Status */
     volatile uint64_t* shared_mem;       /* 0x10: Shared memory pointer */
-    volatile uint64_t reserved[2];       /* 0x18: Reserved/padding */
-} HLS_DATA;  /* 64 bytes */
+    volatile uint64_t reserved[5];       /* 0x18: Reserved/padding to 64 bytes */
+} HLS_DATA;  /* 64 bytes total */
 #endif /* __ASSEMBLER__ */
 
 #define HLS_MAIN_HART_STARTED       0x12344321UL
diff --git a/hal/nxp_t2080.c b/hal/nxp_t2080.c
index 45b49b18..27980b24 100644
--- a/hal/nxp_t2080.c
+++ b/hal/nxp_t2080.c
@@ -19,6 +19,7 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  */
 #include <stdint.h>
+#include <stddef.h>
 #include "target.h"
 #include "printf.h"
 #include "image.h" /* for RAMFUNCTION */
diff --git a/include/printf.h b/include/printf.h
index 860774d3..1163ad4e 100644
--- a/include/printf.h
+++ b/include/printf.h
@@ -48,7 +48,9 @@
 
 /* support for wolfBoot_printf logging */
 #if defined(PRINTF_ENABLED) && !defined(WOLFBOOT_NO_PRINTF)
-#   include <stdio.h>
+#   if !defined(DEBUG_UART) && !defined(DEBUG_ZYNQ) && !defined(WOLFBOOT_DEBUG_EFI)
+#       include <stdio.h>
+#   endif
 #   if defined(DEBUG_ZYNQ) && !defined(USE_QNX) && !defined(DEBUG_UART)
 #       include "xil_printf.h"
 #       define wolfBoot_printf(_f_, ...) xil_printf(_f_, ##__VA_ARGS__)
diff --git a/src/boot_riscv.c b/src/boot_riscv.c
index d9ce3bf0..b7b81427 100644
--- a/src/boot_riscv.c
+++ b/src/boot_riscv.c
@@ -273,7 +273,7 @@ void do_boot(const uint32_t *app_offset)
     unsigned long dts_addr;
     hal_dts_fixup((uint32_t*)dts_offset);
     dts_addr = (unsigned long)dts_offset;
-#else
+#elif defined(WOLFBOOT_RISCV_MMODE) || __riscv_xlen == 64
     unsigned long dts_addr = 0;
 #endif
 
diff --git a/src/boot_riscv_start.S b/src/boot_riscv_start.S
index 5487386f..7ecb0d9b 100644
--- a/src/boot_riscv_start.S
+++ b/src/boot_riscv_start.S
@@ -121,12 +121,11 @@ _copy_params:
     li    t0, MIE_MSIE                 /* wake only on IPI */
     csrw  mie, t0
 
-    /* Set up per-hart stack: base + (hartid+1)*STACK_SIZE_PER_HART */
+    /* Set up per-hart stack: base + hartid*STACK_SIZE_PER_HART */
     csrr  a0, mhartid
     la    t0, _secondary_hart_stack_base
     li    t1, STACK_SIZE_PER_HART
-    addi  a1, a0, 1
-    mul   t2, a1, t1
+    mul   t2, a0, t1
     add   sp, t0, t2
     li    t0, -16
     and   sp, sp, t0
diff --git a/src/string.c b/src/string.c
index b76ce491..93f491ed 100644
--- a/src/string.c
+++ b/src/string.c
@@ -30,7 +30,7 @@
 #if defined(_RENESAS_RA_)
 #include <stdint.h>
 #endif
-#ifndef TARGET_library
+#if !defined(TARGET_library) && defined(__STDC_HOSTED__) && __STDC_HOSTED__
 #include <string.h>
 #else
 size_t strlen(const char *s); /* forward declaration */
@@ -276,7 +276,7 @@ void RAMFUNCTION *memcpy(void *dst, const void *src, size_t n)
 }
 #endif /* IAR */
 
-#ifndef __IAR_SYSTEMS_ICC__
+#if !defined(__IAR_SYSTEMS_ICC__) && !defined(TARGET_X86_64_EFI)
 void *memmove(void *dst, const void *src, size_t n)
 {
     int i;
@@ -293,7 +293,7 @@ void *memmove(void *dst, const void *src, size_t n)
         return memcpy(dst, src, n);
     }
 }
-#endif
+#endif /* !IAR && !X86_64_EFI */
 #endif /* __CCRX__ Renesas CCRX */
 #endif /* WOLFBOOT_USE_STDLIBC */
 
diff --git a/src/x86/exceptions.c b/src/x86/exceptions.c
index c9cdaab9..4b1b4306 100644
--- a/src/x86/exceptions.c
+++ b/src/x86/exceptions.c
@@ -202,7 +202,7 @@ int setup_interrupts()
 
 void deinit_interrupts()
 {
-    idt_descriptor.base = (uintptr_t)NULL;
+    idt_descriptor.base = (uintptr_t)0;
     idt_descriptor.limit = 0xffff;
     asm ("cli\r\n");
     asm ("lidt %0\r\n" : : "m"(idt_descriptor));
diff --git a/test-app/Makefile b/test-app/Makefile
index e0b0d5a3..cb9876ec 100644
--- a/test-app/Makefile
+++ b/test-app/Makefile
@@ -871,7 +871,7 @@ ifeq ($(ELF_FLASH_SCATTER),1)
 SQUASHELF_TOOL = ../tools/squashelf/squashelf
 image-orig.elf: $(APP_OBJS) $(LSCRIPT)
 	@echo "\t[LD] $@"
-	$(Q)$(LD) $(LDFLAGS) $(APP_OBJS) $(OUTPUT_FLAG) $@
+	$(Q)$(LD) $(LDFLAGS) $(APP_OBJS) $(LIBS) $(OUTPUT_FLAG) $@
 
 image.elf: image-orig.elf
 	@echo "\t[SQUASHELF] $@"
@@ -880,7 +880,7 @@ else
 # Default behavior when ELF_FLASH_SCATTER is not set
 image.elf: $(APP_OBJS) $(LSCRIPT)
 	@echo "\t[LD] $@"
-	$(Q)$(LD) $(LDFLAGS) $(APP_OBJS) $(OUTPUT_FLAG) $@
+	$(Q)$(LD) $(LDFLAGS) $(APP_OBJS) $(LIBS) $(OUTPUT_FLAG) $@
 endif
 
 standalone: image.bin
diff --git a/tools/scripts/mpfs_qspi_prog.py b/tools/scripts/mpfs_qspi_prog.py
index df3dfe29..46e553b3 100755
--- a/tools/scripts/mpfs_qspi_prog.py
+++ b/tools/scripts/mpfs_qspi_prog.py
@@ -78,6 +78,10 @@ def main():
     bin_path  = sys.argv[2]
     offset    = int(sys.argv[3], 0) if len(sys.argv) > 3 else 0x20000
 
+    if offset < 0 or offset > 0xFFFFFFFF:
+        print(f"Error: offset out of range (0x0..0xFFFFFFFF, got 0x{offset:X})")
+        sys.exit(1)
+
     if not os.path.exists(bin_path):
         print(f"Error: file not found: {bin_path}")
         sys.exit(1)