diff --git a/class/audio/usbd_audio.c b/class/audio/usbd_audio.c
index aab1a6be..b6b3d274 100644
--- a/class/audio/usbd_audio.c
+++ b/class/audio/usbd_audio.c
@@ -300,7 +300,7 @@ static int audio_class_interface_request_handler(struct usb_setup_packet *setup,
 
                             usbd_audio_get_sampling_freq_table(entity_id, &sampling_freq_table);
                             num = (uint16_t)((uint16_t)(sampling_freq_table[1] << 8) | ((uint16_t)sampling_freq_table[0]));
-                            *data = sampling_freq_table;
+                            memcpy(*data, sampling_freq_table, (12 * num + 2));
                             *len = (12 * num + 2);
                             USB_LOG_DBG("Get sampling_freq_table entity_id:%d ch[%d] addr:%x\r\n", entity_id, ch, (uint32_t)sampling_freq_table);
                         } else {
diff --git a/class/dfu/usbd_dfu.c b/class/dfu/usbd_dfu.c
index 3042e4df..e22dfcaf 100644
--- a/class/dfu/usbd_dfu.c
+++ b/class/dfu/usbd_dfu.c
@@ -130,7 +130,7 @@ static void dfu_request_upload(struct usb_setup_packet *setup, uint8_t **data, u
                 usbd_dfu_cfg.buffer.d8[2] = DFU_CMD_ERASE;
 
                 /* Send the status data over EP0 */
-                *data = usbd_dfu_cfg.buffer.d8;
+                memcpy(*data, usbd_dfu_cfg.buffer.d8, 3);
                 *len = 3;
             } else if (usbd_dfu_cfg.wblock_num > 1U) {
                 usbd_dfu_cfg.dev_state = DFU_STATE_DFU_UPLOAD_IDLE;
@@ -146,7 +146,7 @@ static void dfu_request_upload(struct usb_setup_packet *setup, uint8_t **data, u
                 phaddr = dfu_read_flash((uint8_t *)addr, usbd_dfu_cfg.buffer.d8, usbd_dfu_cfg.wlength);
 
                 /* Send the status data over EP0 */
-                *data = usbd_dfu_cfg.buffer.d8;
+                memcpy(*data, usbd_dfu_cfg.buffer.d8, usbd_dfu_cfg.wlength);
                 *len = usbd_dfu_cfg.wlength;
             } else /* unsupported usbd_dfu_cfg.wblock_num */
             {
@@ -369,9 +369,7 @@ static void dfu_request_getstatus(struct usb_setup_packet *setup, uint8_t **data
     }
 
     /* Send the status data over EP0 */
-    uint8_t temp_data[6];
-    memcpy(temp_data, usbd_dfu_cfg.dev_status, 6);
-    *data = temp_data;
+    memcpy(*data, usbd_dfu_cfg.dev_status, 6);
     *len = 6;
 
     if (usbd_dfu_cfg.firmwar_flag == 1) {
@@ -407,7 +405,7 @@ static void dfu_request_clrstatus(void)
 static void dfu_request_getstate(struct usb_setup_packet *setup, uint8_t **data, uint32_t *len)
 {
     /* Return the current state of the DFU interface */
-    *data = &usbd_dfu_cfg.dev_state;
+    (*data)[0] = usbd_dfu_cfg.dev_state;
     *len = 1;
 }
 
diff --git a/class/msc/usbd_msc.c b/class/msc/usbd_msc.c
index 2220e112..cf249611 100644
--- a/class/msc/usbd_msc.c
+++ b/class/msc/usbd_msc.c
@@ -60,7 +60,7 @@ static int msc_storage_class_interface_request_handler(struct usb_setup_packet *
             break;
 
         case MSC_REQUEST_GET_MAX_LUN:
-            *data = (uint8_t *)(&usbd_msc_cfg.max_lun);
+            (*data)[0] = usbd_msc_cfg.max_lun;
             *len = 1;
             break;