diff --git a/boards/stm32wba55cg_nucleo/board.c b/boards/stm32wba55cg_nucleo/board.c
index 2ac02f1..5e0838c 100644
--- a/boards/stm32wba55cg_nucleo/board.c
+++ b/boards/stm32wba55cg_nucleo/board.c
@@ -253,7 +253,10 @@ whal_Error Board_Init(void)
     if (err)
         return err;
 
-    /* HSE32 -> PLL1 (M=1, N=25, R=3 -> 100 MHz) -> SYSCLK = PLL1 */
+    /* M/N/R are (value-1) encoded per RM0493 (divide/multiply = field + 1):
+     *   f_ref  = HSE32 / (M+1) = 32 / 2  = 16 MHz  (PLL1RGE 8-16)
+     *   f_vco  = f_ref * (N+1) = 16 * 25 = 400 MHz (VCO 128-544)
+     *   SYSCLK = f_vco / (R+1) = 400 / 4 = 100 MHz (part max) */
     err = whal_Stm32wba_Rcc_EnableOsc(
         &(whal_Stm32wba_Rcc_OscCfg){WHAL_STM32WBA_RCC_HSE32_CFG});
     if (err)
@@ -261,7 +264,7 @@ whal_Error Board_Init(void)
     err = whal_Stm32wba_Rcc_EnablePll1(&(whal_Stm32wba_Rcc_Pll1Cfg){
         .clkSrc = WHAL_STM32WBA_RCC_PLL1SRC_HSE32,
         .rge = WHAL_STM32WBA_RCC_PLL1RGE_8_16,
-        .m = 1, .n = 25, .r = 3, .q = 0, .p = 0,
+        .m = 1, .n = 24, .r = 3, .q = 0, .p = 0,
     });
     if (err)
         return err;
diff --git a/src/crypto/stm32n6_cryp.c b/src/crypto/stm32n6_cryp.c
index 257ff36..03920a0 100644
--- a/src/crypto/stm32n6_cryp.c
+++ b/src/crypto/stm32n6_cryp.c
@@ -300,8 +300,11 @@ static whal_Error Process_BlockCipher(const uint8_t *in, uint8_t *out, size_t sz
     if (sz == 0)
         return WHAL_SUCCESS;
 
-    if (!in || !out || (sz & 0xF) != 0)
+    if (!in || !out || (sz & 0xF) != 0) {
+        Disable(base);
+        ZeroKeyIv(base);
         return WHAL_EINVAL;
+    }
 
     for (i = 0; i < sz; i += 16) {
         WriteBlock(base, in + i);
@@ -967,8 +970,11 @@ whal_Error whal_Stm32n6_CrypAesGcm_Process(whal_AesGcm *dev,
     if (sz == 0)
         return WHAL_SUCCESS;
 
-    if (!in || !out)
+    if (!in || !out) {
+        Disable(base);
+        ZeroKeyIv(base);
         return WHAL_EINVAL;
+    }
 
     for (i = 0; i < sz; i += 16) {
         const uint8_t *inPtr = (const uint8_t *)in + i;
@@ -1019,8 +1025,11 @@ whal_Error whal_Stm32n6_CrypAesGcm_Finalize(whal_AesGcm *dev,
     whal_Error err;
     (void)dev;
 
-    if (!tag || tagSz == 0 || tagSz > 16)
+    if (!tag || tagSz == 0 || tagSz > 16) {
+        Disable(base);
+        ZeroKeyIv(base);
         return WHAL_EINVAL;
+    }
 
     /* Final phase */
     Disable(base);
@@ -1476,8 +1485,11 @@ whal_Error whal_Stm32n6_CrypAesCcm_Process(whal_AesCcm *dev,
     if (sz == 0)
         return WHAL_SUCCESS;
 
-    if (!in || !out)
+    if (!in || !out) {
+        Disable(base);
+        ZeroKeyIv(base);
         return WHAL_EINVAL;
+    }
 
     algoDir = whal_GetBits(CRYP_CR_ALGODIR_Msk, CRYP_CR_ALGODIR_Pos,
                            whal_Reg_Read(base, CRYP_CR_REG));
@@ -1536,8 +1548,11 @@ whal_Error whal_Stm32n6_CrypAesCcm_Finalize(whal_AesCcm *dev,
     whal_Error err;
     (void)dev;
 
-    if (!tag || tagSz < 4 || tagSz > 16 || (tagSz & 1) != 0)
+    if (!tag || tagSz < 4 || tagSz > 16 || (tagSz & 1) != 0) {
+        Disable(base);
+        ZeroKeyIv(base);
         return WHAL_EINVAL;
+    }
 
     /* Final phase */
     Disable(base);
diff --git a/src/crypto/stm32wb_aes.c b/src/crypto/stm32wb_aes.c
index e98d67e..ae5c993 100644
--- a/src/crypto/stm32wb_aes.c
+++ b/src/crypto/stm32wb_aes.c
@@ -208,17 +208,18 @@ static whal_Error ProcessBlockCipher(whal_Crypto *cryptoDev,
     if (sz == 0)
         return WHAL_SUCCESS;
 
-    if (!in || !out)
-        return WHAL_EINVAL;
-
-    if ((sz & 0xF) != 0)
+    if (!in || !out || (sz & 0xF) != 0) {
+        whal_Reg_Update(base, AES_CR_REG, AES_CR_EN_Msk, 0);
+        ZeroKeyIv(base);
         return WHAL_EINVAL;
+    }
 
     for (i = 0; i < sz; i += 16) {
         WriteBlock(base, in + i);
         err = WaitForCCF(base, cfg->timeout);
         if (err) {
             whal_Reg_Update(base, AES_CR_REG, AES_CR_EN_Msk, 0);
+            ZeroKeyIv(base);
             return err;
         }
         ReadBlock(base, out + i);
@@ -904,6 +905,7 @@ whal_Error whal_Stm32wb_AesGcm_Start(whal_AesGcm *dev, whal_Crypto_Dir dir,
 
 cleanup:
     whal_Reg_Update(base, AES_CR_REG, AES_CR_EN_Msk, 0);
+    ZeroKeyIv(base);
     return err;
 }
 
@@ -925,8 +927,11 @@ whal_Error whal_Stm32wb_AesGcm_Process(whal_AesGcm *dev,
     if (sz == 0)
         return WHAL_SUCCESS;
 
-    if (!in || !out)
+    if (!in || !out) {
+        whal_Reg_Update(base, AES_CR_REG, AES_CR_EN_Msk, 0);
+        ZeroKeyIv(base);
         return WHAL_EINVAL;
+    }
 
     mode = whal_GetBits(AES_CR_MODE_Msk, AES_CR_MODE_Pos,
                         whal_Reg_Read(base, AES_CR_REG));
@@ -955,6 +960,7 @@ whal_Error whal_Stm32wb_AesGcm_Process(whal_AesGcm *dev,
         err = WaitForCCF(base, cfg->timeout);
         if (err) {
             whal_Reg_Update(base, AES_CR_REG, AES_CR_EN_Msk, 0);
+            ZeroKeyIv(base);
             return err;
         }
 
@@ -987,8 +993,11 @@ whal_Error whal_Stm32wb_AesGcm_Finalize(whal_AesGcm *dev,
 
     (void)dev;
 
-    if (!tag || tagSz == 0 || tagSz > 16)
+    if (!tag || tagSz == 0 || tagSz > 16) {
+        whal_Reg_Update(base, AES_CR_REG, AES_CR_EN_Msk, 0);
+        ZeroKeyIv(base);
         return WHAL_EINVAL;
+    }
 
     /* Final phase (tag) */
     whal_Reg_Update(base, AES_CR_REG,
@@ -1537,6 +1546,7 @@ whal_Error whal_Stm32wb_AesCcm_Start(whal_AesCcm *dev, whal_Crypto_Dir dir,
 
 cleanup:
     whal_Reg_Update(base, AES_CR_REG, AES_CR_EN_Msk, 0);
+    ZeroKeyIv(base);
     return err;
 }
 
@@ -1558,8 +1568,11 @@ whal_Error whal_Stm32wb_AesCcm_Process(whal_AesCcm *dev,
     if (sz == 0)
         return WHAL_SUCCESS;
 
-    if (!in || !out)
+    if (!in || !out) {
+        whal_Reg_Update(base, AES_CR_REG, AES_CR_EN_Msk, 0);
+        ZeroKeyIv(base);
         return WHAL_EINVAL;
+    }
 
     mode = whal_GetBits(AES_CR_MODE_Msk, AES_CR_MODE_Pos,
                         whal_Reg_Read(base, AES_CR_REG));
@@ -1588,6 +1601,7 @@ whal_Error whal_Stm32wb_AesCcm_Process(whal_AesCcm *dev,
         err = WaitForCCF(base, cfg->timeout);
         if (err) {
             whal_Reg_Update(base, AES_CR_REG, AES_CR_EN_Msk, 0);
+            ZeroKeyIv(base);
             return err;
         }
 
@@ -1620,8 +1634,11 @@ whal_Error whal_Stm32wb_AesCcm_Finalize(whal_AesCcm *dev,
 
     (void)dev;
 
-    if (!tag || tagSz < 4 || tagSz > 16 || (tagSz & 1) != 0)
+    if (!tag || tagSz < 4 || tagSz > 16 || (tagSz & 1) != 0) {
+        whal_Reg_Update(base, AES_CR_REG, AES_CR_EN_Msk, 0);
+        ZeroKeyIv(base);
         return WHAL_EINVAL;
+    }
 
     /* Final phase (tag) */
     whal_Reg_Update(base, AES_CR_REG,