diff --git a/emulator/bthost.c b/emulator/bthost.c
index da00b5a..5a32a06 100644
--- a/emulator/bthost.c
+++ b/emulator/bthost.c
@@ -1548,47 +1548,50 @@ static void rfcomm_ua_recv(struct bthost *bthost, struct btconn *conn,
 				struct l2conn *l2conn, const void *data,
 				uint16_t len)
 {
-	const struct rfcomm_cmd *hdr = data;
-	uint8_t channel = RFCOMM_GET_CHANNEL(hdr->address);
+	const struct rfcomm_cmd *ua_hdr = data;
+	uint8_t channel = RFCOMM_GET_CHANNEL(ua_hdr->address);
 	struct rfcomm_connection_data *conn_data = bthost->rfcomm_conn_data;
-	uint8_t type = RFCOMM_GET_TYPE(hdr->control);
-
-	if (!channel && RFCOMM_TEST_CR(type) && conn_data) {
-		uint8_t buf[14];
-		struct rfcomm_hdr *hdr = (struct rfcomm_hdr *)buf;
-		struct rfcomm_mcc *mcc = (struct rfcomm_mcc *)
-							(buf + sizeof(*hdr));
-		struct rfcomm_pn *pn_cmd = (struct rfcomm_pn *)
-							(buf + sizeof(*hdr)
-							+ sizeof(*mcc));
-
-		memset(buf, 0, sizeof(buf));
-
-		hdr->address = RFCOMM_ADDR(1, 0);
-		hdr->control = RFCOMM_CTRL(RFCOMM_UIH, 0);
-		hdr->length  = RFCOMM_LEN8(sizeof(*mcc) + sizeof(*pn_cmd));
-
-		mcc->type = RFCOMM_MCC_TYPE(1, RFCOMM_PN);
-		mcc->length = RFCOMM_LEN8(sizeof(*pn_cmd));
-
-		pn_cmd->dlci = conn_data->channel * 2;
-		pn_cmd->priority = 7;
-		pn_cmd->ack_timer = 0;
-		pn_cmd->max_retrans = 0;
-		pn_cmd->mtu = 667;
-		pn_cmd->credits = 7;
-
-		buf[sizeof(*hdr) + sizeof(*mcc) + sizeof(*pn_cmd)] =
-							rfcomm_fcs(buf);
-
-		send_acl(bthost, conn->handle, l2conn->dcid, buf, sizeof(buf));
-	} else if (conn_data && conn_data->channel == channel) {
+	uint8_t type = RFCOMM_GET_TYPE(ua_hdr->control);
+	uint8_t buf[14];
+	struct rfcomm_hdr *hdr;
+	struct rfcomm_mcc *mcc;
+	struct rfcomm_pn *pn_cmd;
+
+	if (channel && conn_data && conn_data->channel == channel) {
 		if (conn_data->cb)
 			conn_data->cb(conn->handle, l2conn->scid,
 						conn_data->user_data, true);
 		free(bthost->rfcomm_conn_data);
 		bthost->rfcomm_conn_data = NULL;
+		return;
 	}
+
+	if (!conn_data || !RFCOMM_TEST_CR(type))
+		return;
+
+	memset(buf, 0, sizeof(buf));
+
+	hdr = (struct rfcomm_hdr *) buf;
+	mcc = (struct rfcomm_mcc *) (buf + sizeof(*hdr));
+	pn_cmd = (struct rfcomm_pn *) (buf + sizeof(*hdr) + sizeof(*mcc));
+
+	hdr->address = RFCOMM_ADDR(1, 0);
+	hdr->control = RFCOMM_CTRL(RFCOMM_UIH, 0);
+	hdr->length  = RFCOMM_LEN8(sizeof(*mcc) + sizeof(*pn_cmd));
+
+	mcc->type = RFCOMM_MCC_TYPE(1, RFCOMM_PN);
+	mcc->length = RFCOMM_LEN8(sizeof(*pn_cmd));
+
+	pn_cmd->dlci = conn_data->channel * 2;
+	pn_cmd->priority = 7;
+	pn_cmd->ack_timer = 0;
+	pn_cmd->max_retrans = 0;
+	pn_cmd->mtu = 667;
+	pn_cmd->credits = 7;
+
+	buf[sizeof(*hdr) + sizeof(*mcc) + sizeof(*pn_cmd)] = rfcomm_fcs(buf);
+
+	send_acl(bthost, conn->handle, l2conn->dcid, buf, sizeof(buf));
 }
 
 static void rfcomm_dm_recv(struct bthost *bthost, struct btconn *conn,
@@ -1613,10 +1616,11 @@ static void rfcomm_msc_recv(struct bthost *bthost, struct btconn *conn,
 					const struct rfcomm_msc *msc)
 {
 	uint8_t buf[8];
-	struct rfcomm_hdr *hdr = (struct rfcomm_hdr *)buf;
-	struct rfcomm_mcc *mcc = (struct rfcomm_mcc *)(buf + sizeof(*hdr));
-	struct rfcomm_msc *msc_cmd = (struct rfcomm_msc *)(buf + sizeof(*hdr)
-							+ sizeof(*mcc));
+	struct rfcomm_hdr *hdr = (struct rfcomm_hdr *) buf;
+	struct rfcomm_mcc *mcc = (struct rfcomm_mcc *) (buf + sizeof(*hdr));
+	struct rfcomm_msc *msc_cmd = (struct rfcomm_msc *) (buf +
+								sizeof(*hdr) +
+								sizeof(*mcc));
 
 	hdr->address = RFCOMM_ADDR(0, 0);
 	hdr->control = RFCOMM_CTRL(RFCOMM_UIH, 0);