diff --git a/lib/cyw43-driver b/lib/cyw43-driver
index 9bfca61..d976648 160000
--- a/lib/cyw43-driver
+++ b/lib/cyw43-driver
@@ -1 +1 @@
-Subproject commit 9bfca61173a94432839cd39210f1d1afdf602c42
+Subproject commit d97664848b6da6ad6c7dc07fb8901d68cee514af
diff --git a/src/rp2_common/pico_cyw43_driver/cybt_shared_bus/cybt_shared_bus_driver.c b/src/rp2_common/pico_cyw43_driver/cybt_shared_bus/cybt_shared_bus_driver.c
index 8de0f6a..04f7147 100644
--- a/src/rp2_common/pico_cyw43_driver/cybt_shared_bus/cybt_shared_bus_driver.c
+++ b/src/rp2_common/pico_cyw43_driver/cybt_shared_bus/cybt_shared_bus_driver.c
@@ -63,6 +63,7 @@
 #define B2H_BUF_OUT_ADDR            (buf_info.bt2host_out_addr)
 
 static uint32_t wlan_ram_base_addr;
+volatile uint32_t host_ctrl_cache_reg = 0;
 #define WLAN_RAM_BASE_ADDR            (wlan_ram_base_addr)
 
 // In wifi host driver these are all constants
@@ -70,8 +71,7 @@
 #define HOST_CTRL_REG_ADDR          ((uint32_t)0x18000d6c)
 #define WLAN_RAM_BASE_REG_ADDR      ((uint32_t)0x18000d68)
 
-typedef struct
-{
+typedef struct {
     uint32_t host2bt_buf_addr;
     uint32_t host2bt_in_addr;
     uint32_t host2bt_out_addr;
@@ -109,27 +109,19 @@
 #define ROUNDDN(x, a)               ((x) & ~((a) - 1))
 #define ISALIGNED(a, x)             (((uint32_t)(a) & ((x) - 1)) == 0)
 
-typedef struct cybt_fw_cb
-{
+typedef struct cybt_fw_cb {
     const uint8_t *p_fw_mem_start;
     uint32_t fw_len;
     const uint8_t *p_next_line_start;
 } cybt_fw_cb_t;
 
-typedef struct hex_file_data
-{
+typedef struct hex_file_data {
     int addr_mode;
     uint16_t hi_addr;
     uint32_t dest_addr;
     uint8_t *p_ds;
 } hex_file_data_t;
 
-#if USE_SDIO
-#define MAX_BLOCK_SIZE 16384
-#else
-#define MAX_BLOCK_SIZE 64
-#endif
-
 static cyw43_ll_t *cyw43_ll = NULL;
 
 static cybt_result_t cybt_reg_write(uint32_t reg_addr, uint32_t value);
@@ -174,7 +166,7 @@
     return str_len;
 }
 
-static inline uint8_t nibble_for_char(char c){
+static inline uint8_t nibble_for_char(char c) {
     if ((c >= '0') && (c <= '9')) return c - '0';
     if ((c >= 'A') && (c <= 'F')) return c - 'A' + 10;
     return -1;
@@ -559,10 +551,17 @@
 static cybt_result_t cybt_reg_write(uint32_t reg_addr, uint32_t value) {
     cybt_debug("cybt_reg_write 0x%08lx 0x%08lx\n", reg_addr, value);
     cyw43_ll_write_backplane_reg(cyw43_ll, reg_addr, value);
+    if (reg_addr == HOST_CTRL_REG_ADDR) {
+        host_ctrl_cache_reg = value;
+    }
     return CYBT_SUCCESS;
 }
 
 static cybt_result_t cybt_reg_read(uint32_t reg_addr, uint32_t *p_value) {
+    if (reg_addr == HOST_CTRL_REG_ADDR) {
+        *p_value = host_ctrl_cache_reg;
+        return CYBT_SUCCESS;
+    }
     *p_value = cyw43_ll_read_backplane_reg(cyw43_ll, reg_addr);
     cybt_debug("cybt_reg_read 0x%08lx == 0x%08lx\n", reg_addr, *p_value);
     return CYBT_SUCCESS;
@@ -579,7 +578,6 @@
         cybt_debug("0x%02x", bptr[i]);
         if (i != (len - 1)) {
             cybt_debug(", ");
-        } else {
         }
     }
     cybt_debug("\n");
@@ -592,7 +590,10 @@
 static cybt_result_t cybt_mem_write(uint32_t mem_addr, const uint8_t *p_data, uint32_t data_len) {
     cybt_debug("cybt_mem_write addr 0x%08lx len %ld\n", mem_addr, data_len);
     do {
-        uint32_t transfer_size = (data_len > MAX_BLOCK_SIZE) ? MAX_BLOCK_SIZE : data_len;
+        uint32_t transfer_size = (data_len > CYW43_BUS_MAX_BLOCK_SIZE) ? CYW43_BUS_MAX_BLOCK_SIZE : data_len;
+        if ((mem_addr & 0xFFF) + transfer_size > 0x1000) {
+            transfer_size = 0x1000 - (mem_addr & 0xFFF);
+        }
         cyw43_ll_write_backplane_mem(cyw43_ll, mem_addr, transfer_size, p_data);
         cybt_debug("  write_mem addr 0x%08lx len %ld\n", mem_addr, transfer_size);
         DUMP_BYTES(p_data, transfer_size);
@@ -607,8 +608,10 @@
     assert(data_len >= 4);
     cybt_debug("cybt_mem_read addr 0x%08lx len %ld\n", mem_addr, data_len);
     do {
-        uint32_t transfer_size = (data_len > MAX_BLOCK_SIZE) ? MAX_BLOCK_SIZE : data_len;
-        /* this limitation from BT, we need to read twice when spi clock setting is more than 25MHz */
+        uint32_t transfer_size = (data_len > CYW43_BUS_MAX_BLOCK_SIZE) ? CYW43_BUS_MAX_BLOCK_SIZE : data_len;
+        if ((mem_addr & 0xFFF) + transfer_size > 0x1000) {
+            transfer_size = 0x1000 - (mem_addr & 0xFFF);
+        }
         cyw43_ll_read_backplane_mem(cyw43_ll, mem_addr, transfer_size, p_data);
         cybt_debug("  read_mem addr 0x%08lx len %ld\n", transfer_size, mem_addr);
         DUMP_BYTES(p_data, transfer_size);
@@ -645,7 +648,6 @@
             assert(0);
             break;
     }
-
     return addr;
 }
 
diff --git a/src/rp2_common/pico_cyw43_driver/cyw43_bus_pio_spi.c b/src/rp2_common/pico_cyw43_driver/cyw43_bus_pio_spi.c
index 1699330..809635d 100644
--- a/src/rp2_common/pico_cyw43_driver/cyw43_bus_pio_spi.c
+++ b/src/rp2_common/pico_cyw43_driver/cyw43_bus_pio_spi.c
@@ -393,11 +393,12 @@
 
 static inline uint32_t _cyw43_read_reg(cyw43_int_t *self, uint32_t fn, uint32_t reg, uint size) {
     // Padding plus max read size of 32 bits + another 4?
-    static_assert(WHD_BUS_SPI_BACKPLANE_READ_PADD_SIZE % 4 == 0, "");
-    uint32_t buf32[WHD_BUS_SPI_BACKPLANE_READ_PADD_SIZE/4 + 1 + 1];
+    static_assert(CYW43_BACKPLANE_READ_PAD_LEN_BYTES % 4 == 0, "");
+    int index = (CYW43_BACKPLANE_READ_PAD_LEN_BYTES / 4) + 1 + 1;
+    uint32_t buf32[index];
     uint8_t *buf = (uint8_t *)buf32;
-    const uint32_t padding = (fn == BACKPLANE_FUNCTION) ? WHD_BUS_SPI_BACKPLANE_READ_PADD_SIZE : 0; // Add response delay
-    buf32[0] = make_cmd(false, true, fn, reg, size + padding);
+    const uint32_t padding = (fn == BACKPLANE_FUNCTION) ? CYW43_BACKPLANE_READ_PAD_LEN_BYTES : 0; // Add response delay
+    buf32[0] = make_cmd(false, true, fn, reg, size);
 
     if (fn == BACKPLANE_FUNCTION) {
         logic_debug_set(pin_BACKPLANE_READ, 1);
@@ -410,7 +411,7 @@
     if (ret != 0) {
         return ret;
     }
-    uint32_t result = buf32[padding > 0 ? 2 : 1];
+    uint32_t result = buf32[padding > 0 ? index - 1 : 1];
     CYW43_VDEBUG("cyw43_read_reg_u%d %s 0x%lx=0x%lx\n", size * 8, func_name(fn), reg, result);
     return result;
 }
@@ -476,21 +477,21 @@
     return _cyw43_write_reg(self, fn, reg, val, 1);
 }
 
-#if MAX_BLOCK_SIZE > 0x7f8
+#if CYW43_BUS_MAX_BLOCK_SIZE > 0x7f8
 #error Block size is wrong for SPI
 #endif
 
 int cyw43_read_bytes(cyw43_int_t *self, uint32_t fn, uint32_t addr, size_t len, uint8_t *buf) {
-    assert(fn != BACKPLANE_FUNCTION || (len <= 64 && (addr + len) <= 0x8000));
-    const uint32_t padding = (fn == BACKPLANE_FUNCTION) ? 4 : 0; // Add response delay
+    assert(fn != BACKPLANE_FUNCTION || (len <= CYW43_BUS_MAX_BLOCK_SIZE));
+    const uint32_t padding = (fn == BACKPLANE_FUNCTION) ? CYW43_BACKPLANE_READ_PAD_LEN_BYTES : 0; // Add response delay
     size_t aligned_len = (len + 3) & ~3;
     assert(aligned_len > 0 && aligned_len <= 0x7f8);
     assert(buf == self->spid_buf || buf < self->spid_buf || buf >= (self->spid_buf + sizeof(self->spid_buf)));
-    self->spi_header[padding > 0 ? 0 : 1] = make_cmd(false, true, fn, addr, len + padding);
+    self->spi_header[padding > 0 ? 0 : (CYW43_BACKPLANE_READ_PAD_LEN_BYTES / 4)] = make_cmd(false, true, fn, addr, len);
     if (fn == WLAN_FUNCTION) {
         logic_debug_set(pin_WIFI_RX, 1);
     }
-    int ret = cyw43_spi_transfer(self, NULL, 4, (uint8_t *)&self->spi_header[padding > 0 ? 0 : 1], aligned_len + 4 + padding);
+    int ret = cyw43_spi_transfer(self, NULL, 4, (uint8_t *)&self->spi_header[padding > 0 ? 0 : (CYW43_BACKPLANE_READ_PAD_LEN_BYTES / 4)], aligned_len + 4 + padding);
     if (fn == WLAN_FUNCTION) {
         logic_debug_set(pin_WIFI_RX, 0);
     }
@@ -508,8 +509,8 @@
 // Note, uses spid_buf if src isn't using it already
 // Apart from firmware download this appears to only be used for wlan functions?
 int cyw43_write_bytes(cyw43_int_t *self, uint32_t fn, uint32_t addr, size_t len, const uint8_t *src) {
-    assert(fn != BACKPLANE_FUNCTION || (len <= 64 && (addr + len) <= 0x8000));
-    size_t aligned_len = (len + 3) & ~3u;
+    assert(fn != BACKPLANE_FUNCTION || (len <= CYW43_BUS_MAX_BLOCK_SIZE));
+    const size_t aligned_len = (len + 3) & ~3u;
     assert(aligned_len > 0 && aligned_len <= 0x7f8);
     if (fn == WLAN_FUNCTION) {
         // Wait for FIFO to be ready to accept data
@@ -529,17 +530,17 @@
         }
     }
     if (src == self->spid_buf) { // avoid a copy in the usual case just to add the header
-        self->spi_header[1] = make_cmd(true, true, fn, addr, len);
+        self->spi_header[(CYW43_BACKPLANE_READ_PAD_LEN_BYTES / 4)] = make_cmd(true, true, fn, addr, len);
         logic_debug_set(pin_WIFI_TX, 1);
-        int res = cyw43_spi_transfer(self, (uint8_t *)&self->spi_header[1], aligned_len + 4, NULL, 0);
+        int res = cyw43_spi_transfer(self, (uint8_t *)&self->spi_header[(CYW43_BACKPLANE_READ_PAD_LEN_BYTES / 4)], aligned_len + 4, NULL, 0);
         logic_debug_set(pin_WIFI_TX, 0);
         return res;
     } else {
         // todo: would be nice to get rid of this. Only used for firmware download?
         assert(src < self->spid_buf || src >= (self->spid_buf + sizeof(self->spid_buf)));
-        self->spi_header[1] = make_cmd(true, true, fn, addr, len);
+        self->spi_header[(CYW43_BACKPLANE_READ_PAD_LEN_BYTES / 4)] = make_cmd(true, true, fn, addr, len);
         memcpy(self->spid_buf, src, len);
-        return cyw43_spi_transfer(self, (uint8_t *)&self->spi_header[1], aligned_len + 4, NULL, 0);
+        return cyw43_spi_transfer(self, (uint8_t *)&self->spi_header[(CYW43_BACKPLANE_READ_PAD_LEN_BYTES / 4)], aligned_len + 4, NULL, 0);
     }
 }
 #endif