diff --git a/datalink814_ge/src/linklayer/net_mgmt.c b/datalink814_ge/src/linklayer/net_mgmt.c
index 059e0c9..2402b03 100644
--- a/datalink814_ge/src/linklayer/net_mgmt.c
+++ b/datalink814_ge/src/linklayer/net_mgmt.c
@@ -81,8 +81,6 @@ static int32_t MgmtMsg_Packing(L2_INST* instPtr, BIT_ARRAY* bitarr, L2_MSG_TYPE
 			return EPARAM;
 		}
 	}
-	
-	memset(bitarr->words, 0x99, (size_t) (MGMT_MSG_LEN / 8));
 	switch (msgType) {
 	case L2_MSG_TK_INIT:
 		// Series tag
@@ -918,9 +916,6 @@ int32_t MgmtNet_Routine(L2_INST* instPtr, const L2_RTNE_TABLE_ENTRY* rtneEntry){
 	}
 
 	// Update RTT FSM if needed. 
-	if (L2_GetLastFrameType(instPtr) == L2_INTRA_TSYNC_FRAME && L2_GetLastTor(instPtr) == L2_TOR_RX) {
-		RTT_FsmUpdate(instPtr, L2_TOR_RX);
-	} 
 	if (rtneEntry->slotType == L2_SLOT_INTRA_TSYNC) {
 		if(torState == L2_TOR_TX) {
 			RTT_FsmUpdate(instPtr, L2_TOR_TX);
@@ -942,7 +937,7 @@ int32_t MgmtNet_Routine(L2_INST* instPtr, const L2_RTNE_TABLE_ENTRY* rtneEntry){
 		L2_SetupNextSlot(instPtr, torState, L2_INTER_MGMT_FRAME);
 		break;
 	case L2_SLOT_INTRA_MGMT:
-		memset(instPtr->sendPktData, 0xAA, INTRA_MGMT_FRAME_LENGTH_MAX);
+		memset(instPtr->sendPktData, 0xAA, L2_PACKET_LEN_MAX);
 		if (torState == L2_TOR_TX) {
 			if(MgmtPkt_Packing(instPtr, MGMTPKT_INTRA_MGMT) != SUCCESS) {
 				Status = FAILURE;
@@ -957,7 +952,7 @@ int32_t MgmtNet_Routine(L2_INST* instPtr, const L2_RTNE_TABLE_ENTRY* rtneEntry){
 		break;
 	case L2_SLOT_INTRA_TSYNC:
 		if (torState == L2_TOR_TX) {
-			memset(instPtr->sendPktData, 0xAA, INTRA_RTT_FRAME_LENGTH_MAX);
+			memset(instPtr->sendPktData, 0xAA, L2_PACKET_LEN_MAX);
 			if(L2_GetNodeType(instPtr) == L2_NODE_HEAD){
 				if(MgmtPkt_Packing(instPtr, MGMTPKT_INTRA_RTTREQ) != SUCCESS) {
 					Status = FAILURE;
diff --git a/datalink814_ge/src/linklayer/net_scan.c b/datalink814_ge/src/linklayer/net_scan.c
index 2a5e7d8..e2dc93b 100644
--- a/datalink814_ge/src/linklayer/net_scan.c
+++ b/datalink814_ge/src/linklayer/net_scan.c
@@ -141,7 +141,6 @@ static int32_t ScanMsg_Packing(L2_INST* instPtr, BIT_ARRAY* bitarr, L2_MSG_TYPE
 		return (EPARAM);
 	}
 	uint64_t dataChunk = 0;
-	memset(bitarr->words, 0xAA, (size_t)(bitarr->num_of_bits / 8));
 	switch (msgType) {
 	case L2_MSG_BM:
 		if (bitarr->num_of_bits < BM_MSG_LEN) {
@@ -553,6 +552,9 @@ static int32_t Scan_2WAcqHandler (L2_INST* instPtr){
 	else {
 		scanFsmPtr->w2acqTimeout++; // increase counter.
 	}
+	// using pull mode to receive 2wacq frame
+	// since first time sync procedure is accomplished in BM stage. 
+	Phy_SetMode(instPtr->config.phyInstPtr, PHY_MODE_PULL);
 	L2_SetupNextSlot(instPtr, L2_TOR_RX, frameType);
 	return SUCCESS;
 }
@@ -647,7 +649,7 @@ int32_t ScanNet_PktHandler(L2_INST* instPtr) {
 
 			if ( L2_isCxn2Net(instPtr) == false ) {
 				// TODO: Check
-				L2_TimeAlign(instPtr, scanFsmPtr->BMrcvLog.frameNum, scanFsmPtr->BMrcvLog.slotNum, false);
+				L2_TimeAlign(instPtr, scanFsmPtr->BMrcvLog.frameNum, scanFsmPtr->BMrcvLog.slotNum, true);
 			}
 			// trigger flag
 			BmrecvStateUpdate(scanFsmPtr, true);
@@ -979,7 +981,7 @@ int32_t ScanNet_Routine(L2_INST* instPtr, const L2_RTNE_TABLE_ENTRY* rtneEntry)
 				Status = FAILURE;
 				goto routine_err;
 			}
-			memset(instPtr->sendPktData, 0xAA, INTRA_BM_FRAME_LENGTH_MAX);
+			memset(instPtr->sendPktData, 0xAA, L2_PACKET_LEN_MAX);
 			if(ScanPkt_Packing(instPtr, SCANPKT_INTRA_BM) != SUCCESS) {
 				Status = FAILURE;
 				goto routine_err;
@@ -995,12 +997,11 @@ int32_t ScanNet_Routine(L2_INST* instPtr, const L2_RTNE_TABLE_ENTRY* rtneEntry)
 	case L2_SLOT_INTRA_SCAN_2W:
 		if (torState == L2_TOR_TX) {
 			if(L2_GetNodeType(instPtr) != L2_NODE_HEAD && L2_isDataAvail(instPtr) == false) {
-				/* Antenna setting (reserved.) */
-				L2_SetupNextSlot(instPtr, L2_TOR_SUSPEND, L2_INTRA_W2_ACQ_FRAME);
+				// skip...
 				break;
 			}
 			/* Prepare Request/ACK data. */
-			memset(instPtr->sendPktData, 0xAA, (size_t) INTRA_W2ACQ_FRAME_LENGTH_MAX);
+			memset(instPtr->sendPktData, 0xAA, L2_PACKET_LEN_MAX);
 			/* Pack message words */
 			if(ScanPkt_Packing(instPtr, SCANPKT_INTRA_2WACQ) != SUCCESS) {
 				Status = FAILURE;
diff --git a/datalink814_ge/src/linklayer/net_service.c b/datalink814_ge/src/linklayer/net_service.c
index 6add87b..14c6323 100644
--- a/datalink814_ge/src/linklayer/net_service.c
+++ b/datalink814_ge/src/linklayer/net_service.c
@@ -65,7 +65,6 @@ static int UduHeader_Packing(L2_INST* instPtr, BIT_ARRAY* bitarr, uint8_t dst, u
 		return EPARAM;
 	}
 	uint64_t dataChunk = 0;
-	memset(bitarr->words, 0xF0, (size_t)(UDUH_LEN/8));
 	// priority
 	dataChunk = 1;
 	FrameInsertChunk(bitarr, UDUH_PRI_OFFSET, UDUH_PRI_LEN, dataChunk);
@@ -118,7 +117,6 @@ static int PduHeader_Packing(L2_INST* instPtr, BIT_ARRAY* bitarr, L2_PDU_HEADER_
 		if(bitarr->num_of_bits < PDUH0_LEN){
 			return EPARAM;
 		}
-		memset(bitarr->words, 0xF0, (size_t)(PDUH0_LEN/8));
 		// PDU type
 		dataChunk = 0;
 		FrameInsertChunk(bitarr, PDUH0_TYPE_OFFSET, PDUH0_TYPE_LEN, dataChunk);
@@ -141,7 +139,6 @@ static int PduHeader_Packing(L2_INST* instPtr, BIT_ARRAY* bitarr, L2_PDU_HEADER_
 		if(bitarr->num_of_bits < PDUH1_LEN){
 			return EPARAM;
 		}
-		memset(bitarr->words, 0xF0, (size_t)(PDUH1_LEN/8));
 		// PDU type
 		dataChunk = 1;
 		FrameInsertChunk(bitarr, PDUH1_TYPE_OFFSET, PDUH1_TYPE_LEN, dataChunk);
@@ -246,7 +243,6 @@ int32_t ServiceNet_Routine(L2_INST* instPtr, const L2_RTNE_TABLE_ENTRY* rtneEntr
 		DBG_ERROR("Failed to allocate memory for svcMsg.\n");
 		return FAILURE;
 	}
-	memset(instPtr->sendPktData, 0xCC, (size_t)(INTRA_SVC_FRAME_LENGTH_MAX));
 	switch(rtneEntry->slotType){
 	case L2_SLOT_INTER_SVC:
 		L2_SetupNextSlot(instPtr, torState, L2_INTER_SVC_FRAME);
@@ -254,7 +250,7 @@ int32_t ServiceNet_Routine(L2_INST* instPtr, const L2_RTNE_TABLE_ENTRY* rtneEntr
 	case L2_SLOT_INTRA_SVC:
 		if(torState == L2_TOR_TX){
 			//TODO: 
-			memset(instPtr->sendPktData, 0x00, INTRA_SVC_FRAME_LENGTH_MAX);
+			memset(instPtr->sendPktData, 0xAA, L2_PACKET_LEN_MAX);
 			// Pack PDU header
 			if(PduHeader_Packing(instPtr, svcMsg, L2_PDU_HEADER_0, rtneEntry->dst0) != SUCCESS){
 				DBG_ERROR("Failed to packing PduHeader.\n");
diff --git a/datalink814_ge/src/linklayer/schdevent.c b/datalink814_ge/src/linklayer/schdevent.c
index d114907..aeb91aa 100644
--- a/datalink814_ge/src/linklayer/schdevent.c
+++ b/datalink814_ge/src/linklayer/schdevent.c
@@ -323,9 +323,8 @@ void L2_EventPoolHandler(L2_INST* instPtr){
 		DBG_ERROR("Failed to initialize schedule event pool iteration.\n");
 		return;
 	}
-	while (iter->next != NULL)
+	while ((node = list_iterator_next(iter)))
 	{
-		node = list_iterator_next(iter);
 		event = (L2_SCHD_EVENT*)node->val;
 		if(L2_isEventScheduled(event)){
 			if(event->schdFrame == L2_GetCurrentFrameNum(instPtr)