diff --git a/halimpl/hal/phNxpUciHal.cc b/halimpl/hal/phNxpUciHal.cc
index 4b3e5c5..e78b9df 100644
--- a/halimpl/hal/phNxpUciHal.cc
+++ b/halimpl/hal/phNxpUciHal.cc
@@ -50,7 +50,6 @@
 bool uwb_get_platform_id = false;
 uint32_t timeoutTimerId = 0;
 char persistant_log_path[120];
-static uint8_t Rx_data[UCI_MAX_DATA_LEN];
 
 /**************** local methods used in this file only ************************/
 static void phNxpUciHal_write_complete(void* pContext,
@@ -490,23 +489,21 @@
     length += UCI_MSG_HDR_SIZE;
     NXPLOG_UCIHAL_V("read successful length = %d", length);
 
-    nxpucihal_ctrl.p_rx_data = &pInfo->pBuff[index];
-    nxpucihal_ctrl.rx_data_len = length;
-    phNxpUciHal_print_packet(NXP_TML_UCI_RSP_NTF_UWBS_2_AP, nxpucihal_ctrl.p_rx_data, nxpucihal_ctrl.rx_data_len);
+    uint8_t *buffer = &pInfo->pBuff[index];
+    phNxpUciHal_print_packet(NXP_TML_UCI_RSP_NTF_UWBS_2_AP, buffer, length);
 
-    uint8_t mt = ((nxpucihal_ctrl.p_rx_data[0]) & UCI_MT_MASK) >> UCI_MT_SHIFT;
-    uint8_t gid = nxpucihal_ctrl.p_rx_data[0] & UCI_GID_MASK;
-    uint8_t oid = nxpucihal_ctrl.p_rx_data[1] & UCI_OID_MASK;
-    uint8_t pbf = (nxpucihal_ctrl.p_rx_data[0] & UCI_PBF_MASK) >> UCI_PBF_SHIFT;
+    uint8_t mt = ((buffer[0]) & UCI_MT_MASK) >> UCI_MT_SHIFT;
+    uint8_t gid = buffer[0] & UCI_GID_MASK;
+    uint8_t oid = buffer[1] & UCI_OID_MASK;
+    uint8_t pbf = (buffer[0] & UCI_PBF_MASK) >> UCI_PBF_SHIFT;
 
     nxpucihal_ctrl.isSkipPacket = 0;
 
-    phNxpUciHal_rx_handler_check(nxpucihal_ctrl.rx_data_len,
-                                 nxpucihal_ctrl.p_rx_data);
+    phNxpUciHal_rx_handler_check(length, buffer);
 
     // mapping device caps according to Fira 2.0
     if (mt == UCI_MT_RSP && gid == UCI_GID_CORE && oid == UCI_MSG_CORE_GET_CAPS_INFO) {
-      phNxpUciHal_handle_get_caps_info(nxpucihal_ctrl.rx_data_len, nxpucihal_ctrl.p_rx_data);
+      phNxpUciHal_handle_get_caps_info(length, buffer);
     }
 
     /* DBG packets not yet supported, just ignore them silently */
@@ -516,7 +513,7 @@
     }
 
     if (!pbf && mt == UCI_MT_NTF && gid == UCI_GID_CORE && oid == UCI_MSG_CORE_GENERIC_ERROR_NTF) {
-      uint8_t status_code = nxpucihal_ctrl.p_rx_data[UCI_RESPONSE_STATUS_OFFSET];
+      uint8_t status_code = buffer[UCI_RESPONSE_STATUS_OFFSET];
 
       if (status_code == UCI_STATUS_COMMAND_RETRY ||
           status_code == UCI_STATUS_SYNTAX_ERROR) {
@@ -531,7 +528,7 @@
           nxpucihal_ctrl.cmdrsp.WakeupError(UWBSTATUS_COMMAND_RETRANSMIT);
         } else {
           // uci to handle retransmission
-          nxpucihal_ctrl.p_rx_data[UCI_RESPONSE_STATUS_OFFSET] = UCI_STATUS_COMMAND_RETRY;
+          buffer[UCI_RESPONSE_STATUS_OFFSET] = UCI_STATUS_COMMAND_RETRY;
           // TODO: Why this should be treated as fail? once we already patched
           // the status code here. Write operation should be treated as success.
           nxpucihal_ctrl.cmdrsp.WakeupError(UWBSTATUS_FAILED);
@@ -553,14 +550,14 @@
         }
 
         uint8_t status_code = (length > UCI_RESPONSE_STATUS_OFFSET) ?
-          nxpucihal_ctrl.p_rx_data[UCI_RESPONSE_STATUS_OFFSET] : UCI_STATUS_UNKNOWN;
+          buffer[UCI_RESPONSE_STATUS_OFFSET] : UCI_STATUS_UNKNOWN;
 
         if (status_code == UCI_STATUS_OK) {
           nxpucihal_ctrl.cmdrsp.Wakeup(gid, oid);
         } else if ((gid == UCI_GID_CORE) && (oid == UCI_MSG_CORE_SET_CONFIG)){
           /* check if any configurations are not supported then ignore the
             * UWBSTATUS_FEATURE_NOT_SUPPORTED status code*/
-          uint8_t status = phNxpUciHal_process_ext_rsp(length, nxpucihal_ctrl.p_rx_data);
+          uint8_t status = phNxpUciHal_process_ext_rsp(length, buffer);
           if (status == UWBSTATUS_SUCCESS) {
             nxpucihal_ctrl.cmdrsp.Wakeup(gid, oid);
           } else {
@@ -578,8 +575,8 @@
 
     if (!nxpucihal_ctrl.isSkipPacket) {
       /* Read successful, send the event to higher layer */
-      if ((nxpucihal_ctrl.p_uwb_stack_data_cback != NULL) && (nxpucihal_ctrl.rx_data_len <= UCI_MAX_PAYLOAD_LEN)) {
-        (*nxpucihal_ctrl.p_uwb_stack_data_cback)(nxpucihal_ctrl.rx_data_len, nxpucihal_ctrl.p_rx_data);
+      if ((nxpucihal_ctrl.p_uwb_stack_data_cback != NULL) && (length <= UCI_MAX_PAYLOAD_LEN)) {
+        (*nxpucihal_ctrl.p_uwb_stack_data_cback)(length, buffer);
       }
     }
 
@@ -898,8 +895,7 @@
   }
 
   // Initiate UCI packet read
-  status = phTmlUwb_StartRead( Rx_data, UCI_MAX_DATA_LEN,
-            (pphTmlUwb_TransactCompletionCb_t)&phNxpUciHal_read_complete, NULL);
+  status = phTmlUwb_StartRead(&phNxpUciHal_read_complete, NULL);
   if (status != UWBSTATUS_SUCCESS) {
     NXPLOG_UCIHAL_E("read status error status = %x", status);
     return status;
@@ -1107,7 +1103,6 @@
 void phNxpUciHal_send_dev_error_status_ntf()
 {
  NXPLOG_UCIHAL_D("phNxpUciHal_send_dev_error_status_ntf ");
- nxpucihal_ctrl.rx_data_len = 5;
  static uint8_t rsp_data[5] = {0x60, 0x01, 0x00, 0x01, 0xFF};
- (*nxpucihal_ctrl.p_uwb_stack_data_cback)(nxpucihal_ctrl.rx_data_len, rsp_data);
+ (*nxpucihal_ctrl.p_uwb_stack_data_cback)(sizeof(rsp_data), rsp_data);
 }
diff --git a/halimpl/hal/phNxpUciHal.h b/halimpl/hal/phNxpUciHal.h
index c1643ac..2f3faf9 100644
--- a/halimpl/hal/phNxpUciHal.h
+++ b/halimpl/hal/phNxpUciHal.h
@@ -241,10 +241,6 @@
 
   std::unique_ptr<NxpUwbChip> uwb_chip;
 
-  /* Rx data */
-  uint8_t* p_rx_data;
-  uint16_t rx_data_len;
-
   /* libuwb-uci callbacks */
   uwb_stack_callback_t* p_uwb_stack_cback;
   uwb_stack_data_callback_t* p_uwb_stack_data_cback;
@@ -258,8 +254,6 @@
 
   uint16_t cmd_len;
   uint8_t p_cmd_data[UCI_MAX_DATA_LEN];
-  uint16_t rsp_len;
-  uint8_t p_rsp_data[UCI_MAX_DATA_LEN];
 
   /* CORE_DEVICE_INFO_RSP cache */
   bool isDevInfoCached;
diff --git a/halimpl/hal/phNxpUciHal_ext.cc b/halimpl/hal/phNxpUciHal_ext.cc
index e3fb133..69f7342 100644
--- a/halimpl/hal/phNxpUciHal_ext.cc
+++ b/halimpl/hal/phNxpUciHal_ext.cc
@@ -799,14 +799,13 @@
   }
 
   // send country code response to upper layer
-  nxpucihal_ctrl.rx_data_len = 5;
   static uint8_t rsp_data[5] = { 0x4c, 0x01, 0x00, 0x01 };
   if (rt_set->uwb_enable) {
     rsp_data[4] = UWBSTATUS_SUCCESS;
   } else {
     rsp_data[4] = UCI_STATUS_CODE_ANDROID_REGULATION_UWB_OFF;
   }
-  (*nxpucihal_ctrl.p_uwb_stack_data_cback)(nxpucihal_ctrl.rx_data_len, rsp_data);
+  (*nxpucihal_ctrl.p_uwb_stack_data_cback)(sizeof(rsp_data), rsp_data);
 }
 
 // TODO: support fragmented packets
@@ -884,8 +883,7 @@
         static uint8_t rsp_data[] = { 0x41, 0x03, 0x04, 0x04,
           UCI_STATUS_FAILED, 0x01, tlv_tag, UCI_STATUS_CODE_ANDROID_REGULATION_UWB_OFF
         };
-        nxpucihal_ctrl.rx_data_len = sizeof(rsp_data);
-        (*nxpucihal_ctrl.p_uwb_stack_data_cback)(nxpucihal_ctrl.rx_data_len, rsp_data);
+        (*nxpucihal_ctrl.p_uwb_stack_data_cback)(sizeof(rsp_data), rsp_data);
         return true;
       }
     }
diff --git a/halimpl/hal/sr1xx/NxpUwbChipSr1xx.cc b/halimpl/hal/sr1xx/NxpUwbChipSr1xx.cc
index 2299036..d24a32f 100644
--- a/halimpl/hal/sr1xx/NxpUwbChipSr1xx.cc
+++ b/halimpl/hal/sr1xx/NxpUwbChipSr1xx.cc
@@ -26,7 +26,6 @@
   buffer[2] = 0x00;
   buffer[3] = 0x01;
   buffer[4] = binding_status;
-  nxpucihal_ctrl.rx_data_len = 5;
   if (nxpucihal_ctrl.p_uwb_stack_data_cback != NULL) {
     (*nxpucihal_ctrl.p_uwb_stack_data_cback)(data_len, buffer);
   }
@@ -57,7 +56,7 @@
     if (plen < 2) {
       NXPLOG_UCIHAL_E("Otp read: bad payload length %u", plen);
     } else if (p[0] != UCI_STATUS_OK) {
-      NXPLOG_UCIHAL_E("Otp read: bad status=0x%x", nxpucihal_ctrl.p_rx_data[4]);
+      NXPLOG_UCIHAL_E("Otp read: bad status=0x%x", packet[4]);
     } else if (p[1] != len) {
       NXPLOG_UCIHAL_E("Otp read: size mismatch %u (expected %zu for param 0x%x)",
         p[1], len, param_id);
diff --git a/halimpl/tml/phTmlUwb.cc b/halimpl/tml/phTmlUwb.cc
index 7025e2a..966948b 100644
--- a/halimpl/tml/phTmlUwb.cc
+++ b/halimpl/tml/phTmlUwb.cc
@@ -36,6 +36,7 @@
 #define PH_TMLUWB_VALUE_ONE (0x01)
 
 /* Initialize Context structure pointer used to access context structure */
+// TODO: use unique_ptr
 static phTmlUwb_Context_t* gpphTmlUwb_Context;
 
 /* Local Function prototypes */
@@ -505,16 +506,19 @@
 **                  UWBSTATUS_BUSY - read request is already in progress
 **
 *******************************************************************************/
-tHAL_UWB_STATUS phTmlUwb_StartRead(uint8_t* pBuffer, uint16_t wLength,
-                        pphTmlUwb_TransactCompletionCb_t pTmlReadComplete,
-                        void* pContext)
+tHAL_UWB_STATUS phTmlUwb_StartRead(
+  pphTmlUwb_TransactCompletionCb_t pTmlReadComplete,
+  void* pContext)
 {
+  // TODO: move this to gpphTmlUwb_Context
+  static uint8_t shared_rx_buffer[UCI_MAX_DATA_LEN];
+
   /* Check whether TML is Initialized */
   if (!gpphTmlUwb_Context || !gpphTmlUwb_Context->pDevHandle) {
     return PHUWBSTVAL(CID_UWB_TML, UWBSTATUS_NOT_INITIALISED);
   }
 
-  if (!pBuffer || wLength < 1 || !pTmlReadComplete) {
+  if (!pTmlReadComplete) {
     return PHUWBSTVAL(CID_UWB_TML, UWBSTATUS_INVALID_PARAMETER);
   }
 
@@ -523,8 +527,8 @@
   }
 
   /* Setting the flag marks beginning of a Read Operation */
-  gpphTmlUwb_Context->tReadInfo.pBuffer = pBuffer;
-  gpphTmlUwb_Context->tReadInfo.wLength = wLength;
+  gpphTmlUwb_Context->tReadInfo.pBuffer = shared_rx_buffer;
+  gpphTmlUwb_Context->tReadInfo.wLength = sizeof(shared_rx_buffer);
   gpphTmlUwb_Context->tReadInfo.pThread_Callback = pTmlReadComplete;
   gpphTmlUwb_Context->tReadInfo.pContext = pContext;
 
diff --git a/halimpl/tml/phTmlUwb.h b/halimpl/tml/phTmlUwb.h
index 8e5c53b..740587b 100644
--- a/halimpl/tml/phTmlUwb.h
+++ b/halimpl/tml/phTmlUwb.h
@@ -142,9 +142,8 @@
 
 // Reader: caller calls this once, callback will be called for every received packet.
 //         and call StopRead() to unscribe RX packet.
-tHAL_UWB_STATUS phTmlUwb_StartRead(uint8_t* pBuffer, uint16_t wLength,
-                        pphTmlUwb_TransactCompletionCb_t pTmlReadComplete,
-                        void* pContext);
+tHAL_UWB_STATUS phTmlUwb_StartRead(
+  pphTmlUwb_TransactCompletionCb_t pTmlReadComplete, void* pContext);
 void phTmlUwb_StopRead();
 
 void phTmlUwb_Chip_Reset(void);