diff --git a/system/stack/acl/btm_acl.cc b/system/stack/acl/btm_acl.cc
index 75e3fcda89bc0c013329e5483ea8ab5daa63c9b8..33515d6cedf618b3adcb25c4664c8d7eec79fb59 100644
--- a/system/stack/acl/btm_acl.cc
+++ b/system/stack/acl/btm_acl.cc
@@ -1140,6 +1140,17 @@ void StackAclBtmAcl::btm_establish_continue(tACL_CONN* p_acl) {
                 ADDRESS_TO_LOGGABLE_CSTR(p_acl->RemoteAddress()));
     }
     btm_set_link_policy(p_acl, btm_cb.acl_cb_.DefaultLinkPolicy());
+  } else if (p_acl->is_transport_ble()) {
+    tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(p_acl->remote_addr);
+
+    if (p_dev_rec == nullptr) {
+      LOG_WARN("No security record for %s",
+               ADDRESS_TO_LOGGABLE_CSTR(p_acl->RemoteAddress()));
+    } else if (p_dev_rec->is_le_link_key_known()) {
+      btm_ble_set_encryption(
+          p_acl->remote_addr, BTM_BLE_SEC_ENCRYPT,
+          p_dev_rec->role_central ? HCI_ROLE_CENTRAL : HCI_ROLE_PERIPHERAL);
+    }
   }
   NotifyAclLinkUp(*p_acl);
 }
diff --git a/system/stack/eatt/eatt.h b/system/stack/eatt/eatt.h
index a029395a6f813ea61ed662dfe774fd8227431160..ba1d47a627a92b9f6196ce6400d47354d5e8ece1 100644
--- a/system/stack/eatt/eatt.h
+++ b/system/stack/eatt/eatt.h
@@ -99,6 +99,7 @@ class EattChannel {
 
   void EattChannelSetTxMTU(uint16_t tx_mtu) {
     this->tx_mtu_ = std::min<uint16_t>(tx_mtu, EATT_MAX_TX_MTU);
+    this->tx_mtu_ = std::max<uint16_t>(this->tx_mtu_, EATT_MIN_MTU_MPS);
   }
 };
 
diff --git a/system/stack/gatt/gatt_sr.cc b/system/stack/gatt/gatt_sr.cc
index ad8f254054052086d82820087fdd6053f36204fb..3b3fb342a714aa62a3e8ace2353fc767ca41d92e 100644
--- a/system/stack/gatt/gatt_sr.cc
+++ b/system/stack/gatt/gatt_sr.cc
@@ -149,6 +149,13 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) {
   uint8_t* p;
   bool is_overflow = false;
 
+  // We need at least one extra byte for the opcode
+  if (mtu == 0) {
+    LOG(ERROR) << "Invalid MTU";
+    p_cmd->status = GATT_ILLEGAL_PARAMETER;
+    return;
+  }
+
   len = sizeof(BT_HDR) + L2CAP_MIN_OFFSET + mtu;
   BT_HDR* p_buf = (BT_HDR*)osi_calloc(len);
   p_buf->offset = L2CAP_MIN_OFFSET;
@@ -192,7 +199,7 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) {
 
       len = std::min((size_t) p_rsp->attr_value.len, mtu - total_len);
 
-      if (len == 0) {
+      if (total_len == mtu && p_rsp->attr_value.len > 0) {
         VLOG(1) << "Buffer space not enough for this data item, skipping";
         break;
       }