diff --git a/cap/zx297520v3/sources/meta-zxic-custom/conf/distro/vehicle_dc_ref.conf b/cap/zx297520v3/sources/meta-zxic-custom/conf/distro/vehicle_dc_ref.conf
index 85278a4..b6c04c8 100755
--- a/cap/zx297520v3/sources/meta-zxic-custom/conf/distro/vehicle_dc_ref.conf
+++ b/cap/zx297520v3/sources/meta-zxic-custom/conf/distro/vehicle_dc_ref.conf
@@ -292,7 +292,8 @@
 	dropbear \
 	e2fsprogs \
 	iptables \
-	dnsmasq \
+	curl \
+	dnsmasq \	
 	dhcp6 \
 	radvd \
 	iproute2 \
diff --git a/cap/zx297520v3/sources/meta-zxic-custom/recipes-lynq/lynq-qser-sms-demo/files/lynq-qser-sms-demo.cpp b/cap/zx297520v3/sources/meta-zxic-custom/recipes-lynq/lynq-qser-sms-demo/files/lynq-qser-sms-demo.cpp
index 6707bc2..ba29e2d 100755
--- a/cap/zx297520v3/sources/meta-zxic-custom/recipes-lynq/lynq-qser-sms-demo/files/lynq-qser-sms-demo.cpp
+++ b/cap/zx297520v3/sources/meta-zxic-custom/recipes-lynq/lynq-qser-sms-demo/files/lynq-qser-sms-demo.cpp
@@ -125,6 +125,7 @@
     }
     sleep(1);
     QSER_sms_service_center_cfg_t set_sca_cfg;
+    memset(set_sca_cfg.service_center_addr, 0, sizeof(set_sca_cfg.service_center_addr));
     strncpy(set_sca_cfg.service_center_addr, "+8613800230500", 14);//smsc ÊÇ¸ù¾Ý²»Í¬ÔËÓªÉÌ£¬²»Í¬¿¨À´ÅäÖÃµÄ
     qser_sms_setsmscenteraddress = (int (*)(sms_client_handle_type h_sms, QSER_sms_service_center_cfg_t *set_sca_cfg))dlsym(dlHandle_sms,"qser_sms_setsmscenteraddress");
     if(NULL != qser_sms_setsmscenteraddress)
diff --git a/cap/zx297520v3/sources/meta-zxic/recipes-core/dropbear/dropbear.inc b/cap/zx297520v3/sources/meta-zxic/recipes-core/dropbear/dropbear.inc
index e70e030..76d89cc 100755
--- a/cap/zx297520v3/sources/meta-zxic/recipes-core/dropbear/dropbear.inc
+++ b/cap/zx297520v3/sources/meta-zxic/recipes-core/dropbear/dropbear.inc
@@ -14,8 +14,10 @@
 
 DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
 
+#l.yang modify for feature  id ZXW-174 2023/10/28 start 
 SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
            file://0001-urandom-xauth-changes-to-options.h.patch \
+           file://0100-zxic-modify-DEFAULT_PATH.patch \
            file://init \
            file://dropbearkey.service \
            file://dropbear@.service \
@@ -23,6 +25,7 @@
            file://dropbear.default \
            ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
            ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} "
+#l.yang modify for feature  id ZXW-174 2023/10/28 end
 
 PAM_SRC_URI = "file://0005-dropbear-enable-pam.patch \
                file://0006-dropbear-configuration-file.patch \
diff --git a/cap/zx297520v3/sources/meta-zxic/recipes-core/dropbear/dropbear/0100-zxic-modify-DEFAULT_PATH.patch b/cap/zx297520v3/sources/meta-zxic/recipes-core/dropbear/dropbear/0100-zxic-modify-DEFAULT_PATH.patch
new file mode 100755
index 0000000..a1f45a2
--- /dev/null
+++ b/cap/zx297520v3/sources/meta-zxic/recipes-core/dropbear/dropbear/0100-zxic-modify-DEFAULT_PATH.patch
@@ -0,0 +1,25 @@
+From 49bfddc165f9e7ec7fe0d8189e7ed430b5284315 Mon Sep 17 00:00:00 2001
+From: =?utf-8?q?=E5=91=A8=E5=9B=BD=E5=9D=A1=200318000136?=
+ <zhou.guopo@sanechips.com.cn>
+Date: Thu, 26 Oct 2023 16:04:55 +0800
+Subject: [PATCH] modify DEFAULT_PATH
+
+---
+ default_options.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/default_options.h b/default_options.h
+index 7ff1394..6831c6d 100644
+--- a/default_options.h
++++ b/default_options.h
+@@ -309,6 +309,6 @@ be overridden at runtime with -I. 0 disables idle timeouts */
+ #define DEFAULT_IDLE_TIMEOUT 0
+ 
+ /* The default path. This will often get replaced by the shell */
+-#define DEFAULT_PATH "/usr/bin:/bin"
++#define DEFAULT_PATH "/sbin:/usr/sbin:/usr/bin:/bin"
+ 
+ #endif /* DROPBEAR_DEFAULT_OPTIONS_H_ */
+-- 
+2.17.1
+
diff --git a/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/data/data.cpp b/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/data/data.cpp
index fbeaefe..71bc7f1 100755
--- a/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/data/data.cpp
+++ b/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/data/data.cpp
@@ -999,7 +999,7 @@
     writeStringToParcel(p,password);
     writeStringToParcel(p,authtype);
     writeStringToParcel(p,pdp_type);//protocol == (ZXW)pdp_type
-    if(strcmp(apn, "default") == 0)
+    if(strcmp(apntype, "iot_default") == 0 || strcmp(apntype, "default") == 0)
     {
         writeStringToParcel(p, normal_pdp);//((const char **)data)[7] set "2"，use normal_pdp datacall
         RLOGD("setupDataCallargc:It is normal pdp data call");
diff --git a/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/lynq_common.cpp b/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/lynq_common.cpp
index 8989350..b476b01 100755
--- a/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/lynq_common.cpp
+++ b/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/lynq_common.cpp
@@ -40,6 +40,7 @@
     {-1, "", "", "", -1, -1, -1, ""}, \
     {-1, "", "", "", -1, -1, -1, ""}, \
     {-1, "", "", "", -1, -1, -1, ""}, \
+    {-1, "", "", "", -1, -1, -1, ""}, \
     {-1, "", "", "", -1, -1, -1, ""},
 };
 #endif
diff --git a/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/lynq_common.h b/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/lynq_common.h
index ff3dd2b..6d207d3 100755
--- a/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/lynq_common.h
+++ b/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/lynq_common.h
@@ -40,7 +40,7 @@
 #define LYNQ_APNTPYE_LEN_MAX 50
 #define LYNQ_IFNAME_LEN_MAX 10
 #define LYNQ_ADDRESS_LEN_MAX 100
-#define LYNQ_APN_CHANNEL_MAX 7//max is 7
+#define LYNQ_APN_CHANNEL_MAX 8//max is 8
 #define LYNQ_AT_LEN_MAX 20
 #define LYNQ_EVENT_WAIT_TIME_MAX 25 //m
 
diff --git a/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/ril.cpp b/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/ril.cpp
index 76f99b3..9cbb684 100755
--- a/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/ril.cpp
+++ b/cap/zx297520v3/src/lynq/framework/lynq-ril-service/src/ril.cpp
@@ -4142,7 +4142,29 @@
         errorOffset = p.dataPosition();
 
         p.writeInt32 (e);
-
+        #ifdef MOBILETEK_TARGET_PLATFORM_T106
+        //xf.li@20231102 add for t106 data start
+        if(response == NULL && pRI->pCI->requestNumber == RIL_REQUEST_SETUP_DATA_CALL)
+        {
+            for(int j = 0; j < LYNQ_APN_CHANNEL_MAX; j++)
+            {
+                if(lynq_apn_cid_table[j].used == 1 && lynq_apn_cid_table[j].dialing == 1)
+                {
+                    //delete
+                    bzero(lynq_apn_cid_table[j].apn,LYNQ_APN_LEN_MAX);
+                    bzero(lynq_apn_cid_table[j].apntype,LYNQ_APNTPYE_LEN_MAX);
+                    bzero(lynq_apn_cid_table[j].ifaceName,LYNQ_IFNAME_LEN_MAX);
+                    bzero(lynq_apn_cid_table[j].address,LYNQ_ADDRESS_LEN_MAX);
+                    lynq_apn_cid_table[j].cid = -1;
+                    lynq_apn_cid_table[j].used = -1;
+                    lynq_apn_cid_table[j].status = -1;
+                    lynq_apn_cid_table[j].dialing = -1;
+                    break;
+                }
+            }
+        }
+        //xf.li@20231102 add for t106 data start
+        #endif
         if (response != NULL) {
             // there is a response payload, no matter success or not.
             ret = pRI->pCI->responseFunction(p, response, responselen);
@@ -5579,6 +5601,7 @@
         {        
             char* tmp[2] = {"RIL_REQUEST_RADIO_POWER", "1"};
             setRadioPower(2,tmp, (RIL_SOCKET_ID) (id), info);
+            break;
         }
         default:
             RLOGE("don't support  %d in init", id);
diff --git a/cap/zx297520v3/src/lynq/lib/liblynq-data/lynq_data.cpp b/cap/zx297520v3/src/lynq/lib/liblynq-data/lynq_data.cpp
index 49363ad..e7bda42 100755
--- a/cap/zx297520v3/src/lynq/lib/liblynq-data/lynq_data.cpp
+++ b/cap/zx297520v3/src/lynq/lib/liblynq-data/lynq_data.cpp
@@ -964,7 +964,7 @@
     //xf.li@20230610 add for T106 data start
     #ifdef MOBILETEK_TARGET_PLATFORM_T106
     LYINFLOG("[%s][%d] call lynq_setup_data_call_sp",__FUNCTION__,__LINE__);
-    error = lynq_setup_data_call_sp_t106(handle,"default","iot_default",NULL,NULL,NULL,NULL,NULL);
+    error = lynq_setup_data_call_sp_t106(handle,"default","default",NULL,NULL,NULL,NULL,NULL);
     return error;
     #else
     //xf.li@20230610 add for T106 data end
diff --git a/cap/zx297520v3/src/lynq/lib/liblynq-qser-data/lynq-qser-data.cpp b/cap/zx297520v3/src/lynq/lib/liblynq-qser-data/lynq-qser-data.cpp
index dc996f4..1f49fe6 100755
--- a/cap/zx297520v3/src/lynq/lib/liblynq-qser-data/lynq-qser-data.cpp
+++ b/cap/zx297520v3/src/lynq/lib/liblynq-qser-data/lynq-qser-data.cpp
@@ -628,10 +628,10 @@
     apn->profile_idx = (unsigned char)atoi(xmlGetProp(modify_node, "profile_idx"));
     apn->pdp_type = (qser_apn_pdp_type_e)atoi(xmlGetProp(modify_node, "pdp_type"));
     apn->auth_proto = (qser_apn_auth_proto_e)atoi(xmlGetProp(modify_node, "auth_proto"));
-    strcpy(apn->apn_name,(char *)xmlGetProp(modify_node, "apn_name"));
-    strcpy(apn->username,(char *)xmlGetProp(modify_node, "username"));
-    strcpy(apn->password,(char *)xmlGetProp(modify_node, "password"));
-    strcpy(apn->apn_type,(char *)xmlGetProp(modify_node, "apn_type"));
+    strncpy(apn->apn_name,(char *)xmlGetProp(modify_node, "apn_name"), QSER_APN_NAME_SIZE);
+    strncpy(apn->username,(char *)xmlGetProp(modify_node, "username"), QSER_APN_USERNAME_SIZE);
+    strncpy(apn->password,(char *)xmlGetProp(modify_node, "password"), QSER_APN_PASSWORD_SIZE);
+    strncpy(apn->apn_type,(char *)xmlGetProp(modify_node, "apn_type"), QSER_APN_NAME_SIZE);
     xmlSaveFormatFileEnc(data_xml_path, pdoc, "UTF-8", 1);
     xmlFreeDoc(pdoc);
     return RESULT_OK;
@@ -679,10 +679,10 @@
         apn_list->apn[node_num].profile_idx = (unsigned char)atoi(temp);
         apn_list->apn[node_num].pdp_type = (qser_apn_pdp_type_e)atoi(xmlGetProp(modify_node, "pdp_type"));
         apn_list->apn[node_num].auth_proto = (qser_apn_auth_proto_e)atoi(xmlGetProp(modify_node, "auth_proto"));
-        strcpy(apn_list->apn[node_num].apn_name,(char *)xmlGetProp(modify_node, "apn_name"));
-        strcpy(apn_list->apn[node_num].username,(char *)xmlGetProp(modify_node, "username"));
-        strcpy(apn_list->apn[node_num].password,(char *)xmlGetProp(modify_node, "password"));
-        strcpy(apn_list->apn[node_num].apn_type,(char *)xmlGetProp(modify_node, "apn_type"));
+        strncpy(apn_list->apn[node_num].apn_name,(char *)xmlGetProp(modify_node, "apn_name"), QSER_APN_NAME_SIZE);
+        strncpy(apn_list->apn[node_num].username,(char *)xmlGetProp(modify_node, "username"), QSER_APN_USERNAME_SIZE);
+        strncpy(apn_list->apn[node_num].password,(char *)xmlGetProp(modify_node, "password"), QSER_APN_PASSWORD_SIZE);
+        strncpy(apn_list->apn[node_num].apn_type,(char *)xmlGetProp(modify_node, "apn_type"), QSER_APN_NAME_SIZE);
         node_num ++;
         modify_node = modify_node->next;
     }
@@ -1082,6 +1082,7 @@
         LYERRLOG("apn_xml_modify error");
         return ret;
     }
+#ifndef MOBILETEK_TARGET_PLATFORM_T106
     int apn_id = 0;
     char tmp_id[12];
     char *outinfo = NULL;
@@ -1098,7 +1099,8 @@
     LYINFLOG("[output]:%s",outinfo);
     free(outinfo);
     outinfo = NULL;
-    return RESULT_OK;
+#endif
+    return ret;
 }
 
 int qser_apn_get(unsigned char profile_idx, qser_apn_info_s *apn)
@@ -1132,6 +1134,7 @@
         LYERRLOG("apn_xml_add error");
         return ret;
     }
+#ifndef MOBILETEK_TARGET_PLATFORM_T106
     int apn_id = 0;
     char tmp_id[12];
     char *outinfo = NULL;
@@ -1147,7 +1150,8 @@
     LYINFLOG("[output]:%s",outinfo);
     free(outinfo);
     outinfo = NULL;
-    return RESULT_OK;
+#endif
+    return ret;
 }
 
 int qser_apn_del(unsigned char profile_idx)
@@ -1164,6 +1168,7 @@
         LYERRLOG("apn_xml_delete error");
         return ret;
     }
+#ifndef MOBILETEK_TARGET_PLATFORM_T106
     int apn_id = 0;
     char tmp_id[12];
     char *outinfo = NULL;
@@ -1176,6 +1181,7 @@
     LYINFLOG("[output]:%s",outinfo);
     free(outinfo);
     outinfo = NULL;
+#endif
     return ret;
 }
 
diff --git a/cap/zx297520v3/src/lynq/lib/liblynq-qser-data/lynq_qser_data_apn.xml b/cap/zx297520v3/src/lynq/lib/liblynq-qser-data/lynq_qser_data_apn.xml
old mode 100644
new mode 100755
index ddc89a9..c9c8304
--- a/cap/zx297520v3/src/lynq/lib/liblynq-qser-data/lynq_qser_data_apn.xml
+++ b/cap/zx297520v3/src/lynq/lib/liblynq-qser-data/lynq_qser_data_apn.xml
@@ -1,3 +1,3 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <lynq_qser_data_apn>
-  <apn profile_idx="0" pdp_type="3" auth_proto="0" apn_name="default" username="NULL" password="NULL" apn_type="iot_default"/></lynq_qser_data_apn>
+  <apn profile_idx="0" pdp_type="3" auth_proto="0" apn_name="default" username="NULL" password="NULL" apn_type="default"/></lynq_qser_data_apn>
diff --git a/cap/zx297520v3/src/lynq/packages/apps/Mobiletek_Tester_RDIT/sim.h b/cap/zx297520v3/src/lynq/packages/apps/Mobiletek_Tester_RDIT/sim.h
index ce6a254..3788742 100755
--- a/cap/zx297520v3/src/lynq/packages/apps/Mobiletek_Tester_RDIT/sim.h
+++ b/cap/zx297520v3/src/lynq/packages/apps/Mobiletek_Tester_RDIT/sim.h
@@ -18,6 +18,8 @@
 int deinit_sim(int argc, char *argv[], int sp_test);
 int get_version(int argc, char *argv[], int sp_test);
 int reset_modem(int argc, char *argv[], int sp_test);
+int get_msisdn(int argc, char *argv[], int sp_test);
+//int reset_simcard(int argc, char *argv[], int sp_test);
 
 //QSER SIM
 int qser_init_sim(int argc, char *argv[], int sp_test);