diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 9cfde68d0..448bfa06e 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -38,7 +38,7 @@ include:
 .fedora:
   variables:
     # Update this tag when you want to trigger a rebuild
-    FDO_DISTRIBUTION_TAG: '2025-10-15.0'
+    FDO_DISTRIBUTION_TAG: '2025-10-22.0'
     FDO_DISTRIBUTION_VERSION: '42'
     FDO_DISTRIBUTION_PACKAGES: >-
       alsa-lib-devel
@@ -48,6 +48,7 @@ include:
       dbus-devel
       doxygen
       fdk-aac-free-devel
+      file
       findutils
       gcc
       gcc-c++
diff --git a/meson.build b/meson.build
index e81ce8214..e82ba03b3 100644
--- a/meson.build
+++ b/meson.build
@@ -118,8 +118,8 @@ cc_flags = common_flags + [
   '-DSPA_AUDIO_MAX_CHANNELS=128u',
 ]
 add_project_arguments(cc.get_supported_arguments(cc_flags), language: 'c')
-
-cc_flags_native = cc_native.get_supported_arguments(cc_flags)
+add_project_arguments(cc_native.get_supported_arguments(cc_flags),
+                      language: 'c', native: true)
 
 have_cpp = add_languages('cpp', native: false, required : false)
 
diff --git a/spa/examples/adapter-control.c b/spa/examples/adapter-control.c
index 6aa36dfaa..0a48f2fd4 100644
--- a/spa/examples/adapter-control.c
+++ b/spa/examples/adapter-control.c
@@ -578,7 +578,7 @@ static int make_nodes(struct data *data)
 		SPA_PARAM_PORT_CONFIG_direction,	SPA_POD_Id(SPA_DIRECTION_OUTPUT),
 		SPA_PARAM_PORT_CONFIG_mode,		SPA_POD_Id(SPA_PARAM_PORT_CONFIG_MODE_dsp),
 		SPA_PARAM_PORT_CONFIG_format,		SPA_POD_Pod(param));
-	if ((res = spa_node_set_param(data->source_node, SPA_PARAM_PortConfig, 0, param) < 0)) {
+	if ((res = spa_node_set_param(data->source_node, SPA_PARAM_PortConfig, 0, param)) < 0) {
 		printf("can't setup source node %d\n", res);
 		return res;
 	}
@@ -647,7 +647,7 @@ static int make_nodes(struct data *data)
 			SPA_PARAM_PORT_CONFIG_format, SPA_POD_Pod(param));
 
 
-	if ((res = spa_node_set_param(data->sink_node, SPA_PARAM_PortConfig, 0, param) < 0)) {
+	if ((res = spa_node_set_param(data->sink_node, SPA_PARAM_PortConfig, 0, param)) < 0) {
 		printf("can't setup sink node %d\n", res);
 		return res;
 	}
@@ -987,7 +987,7 @@ int main(int argc, char *argv[])
 
 	setlocale(LC_ALL, "");
 
-	while ((c = getopt_long(argc, argv, "hdmstiac:", long_options, NULL)) != -1) {
+	while ((c = getopt_long(argc, argv, "hd:m:s:t:i:a:c:", long_options, NULL)) != -1) {
 		switch (c) {
 		case 'h':
 			show_help(&data, argv[0], false);
diff --git a/spa/include/spa/param/audio/format-utils.h b/spa/include/spa/param/audio/format-utils.h
index 07f5d94e3..24d06dd1e 100644
--- a/spa/include/spa/param/audio/format-utils.h
+++ b/spa/include/spa/param/audio/format-utils.h
@@ -46,20 +46,61 @@ extern "C" {
  #endif
 #endif
 
+SPA_API_AUDIO_FORMAT_UTILS bool
+spa_format_audio_ext_valid_size(uint32_t media_subtype, size_t size)
+{
+	switch (media_subtype) {
+	case SPA_MEDIA_SUBTYPE_raw:
+		return size >= offsetof(struct spa_audio_info, info.raw) &&
+			SPA_AUDIO_INFO_RAW_VALID_SIZE(size - offsetof(struct spa_audio_info, info.raw));
+
+#define _SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(format)	\
+		case SPA_MEDIA_SUBTYPE_ ## format: \
+			return size >= offsetof(struct spa_audio_info, info.format) + sizeof(struct spa_audio_info_ ## format);
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(dsp)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(iec958)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(dsd)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(mp3)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(aac)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(vorbis)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(wma)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(ra)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(amr)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(alac)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(flac)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(ape)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(ac3)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(eac3)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(truehd)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(dts)
+	_SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE(mpegh)
+#undef _SPA_FORMAT_AUDIO_EXT_VALID_SIZE_CASE
+	}
+	return false;
+}
+
 SPA_API_AUDIO_FORMAT_UTILS int
 spa_format_audio_ext_parse(const struct spa_pod *format, struct spa_audio_info *info, size_t size)
 {
 	int res;
+	uint32_t media_type, media_subtype;
 
-	if ((res = spa_format_parse(format, &info->media_type, &info->media_subtype)) < 0)
+	if ((res = spa_format_parse(format, &media_type, &media_subtype)) < 0)
 		return res;
 
-	if (info->media_type != SPA_MEDIA_TYPE_audio)
+	if (media_type != SPA_MEDIA_TYPE_audio)
 		return -EINVAL;
 
-	switch (info->media_subtype) {
+	if (!spa_format_audio_ext_valid_size(media_subtype, size))
+		return -EINVAL;
+
+	info->media_type = media_type;
+	info->media_subtype = media_subtype;
+
+	switch (media_subtype) {
 	case SPA_MEDIA_SUBTYPE_raw:
-		return spa_format_audio_raw_ext_parse(format, &info->info.raw, size);
+		return spa_format_audio_raw_ext_parse(format, &info->info.raw,
+				size - offsetof(struct spa_audio_info, info.raw));
 	case SPA_MEDIA_SUBTYPE_dsp:
 		return spa_format_audio_dsp_parse(format, &info->info.dsp);
 	case SPA_MEDIA_SUBTYPE_iec958:
@@ -108,9 +149,15 @@ SPA_API_AUDIO_FORMAT_UTILS struct spa_pod *
 spa_format_audio_ext_build(struct spa_pod_builder *builder, uint32_t id,
 		       const struct spa_audio_info *info, size_t size)
 {
+	if (!spa_format_audio_ext_valid_size(info->media_subtype, size)) {
+		errno = EINVAL;
+		return NULL;
+	}
+
 	switch (info->media_subtype) {
 	case SPA_MEDIA_SUBTYPE_raw:
-		return spa_format_audio_raw_ext_build(builder, id, &info->info.raw, size);
+		return spa_format_audio_raw_ext_build(builder, id, &info->info.raw,
+				size - offsetof(struct spa_audio_info, info.raw));
 	case SPA_MEDIA_SUBTYPE_dsp:
 		return spa_format_audio_dsp_build(builder, id, &info->info.dsp);
 	case SPA_MEDIA_SUBTYPE_iec958:
diff --git a/spa/include/spa/param/audio/format.h b/spa/include/spa/param/audio/format.h
index ac9b10dda..6e7a71f6c 100644
--- a/spa/include/spa/param/audio/format.h
+++ b/spa/include/spa/param/audio/format.h
@@ -59,6 +59,8 @@ struct spa_audio_info {
 		struct spa_audio_info_dts dts;
 		struct spa_audio_info_mpegh mpegh;
 	} info;
+
+	/* padding follows here when info has flexible size */
 };
 
 /**
diff --git a/spa/include/spa/param/audio/raw-json.h b/spa/include/spa/param/audio/raw-json.h
index c33a9310f..38fcb449c 100644
--- a/spa/include/spa/param/audio/raw-json.h
+++ b/spa/include/spa/param/audio/raw-json.h
@@ -60,6 +60,10 @@ spa_audio_info_raw_ext_update(struct spa_audio_info_raw *info, size_t size,
 {
 	uint32_t v;
 	uint32_t max_position = SPA_AUDIO_INFO_RAW_MAX_POSITION(size);
+
+	if (!SPA_AUDIO_INFO_RAW_VALID_SIZE(size))
+		return -EINVAL;
+
 	if (spa_streq(key, SPA_KEY_AUDIO_FORMAT)) {
 		if (force || info->format == 0)
 			info->format = (enum spa_audio_format)spa_type_audio_format_from_short_name(val);
@@ -78,6 +82,7 @@ spa_audio_info_raw_ext_update(struct spa_audio_info_raw *info, size_t size,
 						max_position, &v) > 0) {
 				if (v > max_position)
 					return -ECHRNG;
+				info->channels = v;
 				SPA_FLAG_CLEAR(info->flags, SPA_AUDIO_FLAG_UNPOSITIONED);
 			}
 		}
@@ -99,6 +104,9 @@ spa_audio_info_raw_ext_init_dict_keys_va(struct spa_audio_info_raw *info, size_t
 {
 	int res;
 
+	if (!SPA_AUDIO_INFO_RAW_VALID_SIZE(size))
+		return -EINVAL;
+
 	memset(info, 0, size);
 	SPA_FLAG_SET(info->flags, SPA_AUDIO_FLAG_UNPOSITIONED);
 	if (dict) {
diff --git a/spa/include/spa/param/audio/raw-utils.h b/spa/include/spa/param/audio/raw-utils.h
index ce5e61e67..3bb94eaa3 100644
--- a/spa/include/spa/param/audio/raw-utils.h
+++ b/spa/include/spa/param/audio/raw-utils.h
@@ -35,6 +35,9 @@ spa_format_audio_raw_ext_parse(const struct spa_pod *format, struct spa_audio_in
 	int res;
 	uint32_t max_position = SPA_AUDIO_INFO_RAW_MAX_POSITION(size);
 
+	if (!SPA_AUDIO_INFO_RAW_VALID_SIZE(size))
+		return -EINVAL;
+
 	info->flags = 0;
 	res = spa_pod_parse_object(format,
 			SPA_TYPE_OBJECT_Format, NULL,
@@ -64,6 +67,11 @@ spa_format_audio_raw_ext_build(struct spa_pod_builder *builder, uint32_t id,
 	struct spa_pod_frame f;
 	uint32_t max_position = SPA_AUDIO_INFO_RAW_MAX_POSITION(size);
 
+	if (!SPA_AUDIO_INFO_RAW_VALID_SIZE(size)) {
+		errno = EINVAL;
+		return NULL;
+	}
+
 	spa_pod_builder_push_object(builder, &f, SPA_TYPE_OBJECT_Format, id);
 	spa_pod_builder_add(builder,
 			SPA_FORMAT_mediaType,		SPA_POD_Id(SPA_MEDIA_TYPE_audio),
diff --git a/spa/include/spa/param/audio/raw.h b/spa/include/spa/param/audio/raw.h
index 392b65daa..bcc0a122d 100644
--- a/spa/include/spa/param/audio/raw.h
+++ b/spa/include/spa/param/audio/raw.h
@@ -293,6 +293,8 @@ struct spa_audio_info_raw {
 
 #define SPA_AUDIO_INFO_RAW_MAX_POSITION(size)	(((size)-offsetof(struct spa_audio_info_raw,position))/sizeof(uint32_t))
 
+#define SPA_AUDIO_INFO_RAW_VALID_SIZE(size)	((size) >= offsetof(struct spa_audio_info_raw, position))
+
 
 #define SPA_KEY_AUDIO_FORMAT		"audio.format"		/**< an audio format as string,
 								  *  Ex. "S16LE" */
diff --git a/spa/include/spa/utils/json-core.h b/spa/include/spa/utils/json-core.h
index 800763571..5616bffe1 100644
--- a/spa/include/spa/utils/json-core.h
+++ b/spa/include/spa/utils/json-core.h
@@ -54,6 +54,15 @@ SPA_API_JSON void spa_json_init(struct spa_json * iter, const char *data, size_t
 {
 	*iter =  SPA_JSON_INIT(data, size);
 }
+
+#define SPA_JSON_INIT_RELAX(type,data,size) \
+	((struct spa_json) { (data), (data)+(size), NULL, (uint32_t)((type) == '[' ? 0x10 : 0x0), 0 })
+
+SPA_API_JSON void spa_json_init_relax(struct spa_json * iter, char type, const char *data, size_t size)
+{
+	*iter =  SPA_JSON_INIT_RELAX(type, data, size);
+}
+
 #define SPA_JSON_ENTER(iter) ((struct spa_json) { (iter)->cur, (iter)->end, (iter), (iter)->state & 0xff0, 0 })
 
 SPA_API_JSON void spa_json_enter(struct spa_json * iter, struct spa_json * sub)
diff --git a/spa/include/spa/utils/json.h b/spa/include/spa/utils/json.h
index c8030345e..212637dab 100644
--- a/spa/include/spa/utils/json.h
+++ b/spa/include/spa/utils/json.h
@@ -105,7 +105,7 @@ SPA_API_JSON_UTILS int spa_json_begin_container(struct spa_json * iter,
 	spa_json_init(iter, data, size);
 	res = spa_json_enter_container(iter, iter, type);
 	if (res == -EPROTO && relax)
-		spa_json_init(iter, data, size);
+		spa_json_init_relax(iter, type, data, size);
 	else if (res <= 0)
 		return res;
 	return 1;
diff --git a/spa/plugins/alsa/acp/acp.c b/spa/plugins/alsa/acp/acp.c
index 364d71eb0..c2197c145 100644
--- a/spa/plugins/alsa/acp/acp.c
+++ b/spa/plugins/alsa/acp/acp.c
@@ -245,7 +245,7 @@ static void init_device(pa_card *impl, pa_alsa_device *dev, pa_alsa_direction_t
 		pa_proplist_update(dev->proplist, PA_UPDATE_REPLACE, m->input_proplist);
 	}
 	if (m->split) {
-		char pos[2048];
+		char pos[PA_CHANNELS_MAX*8];
 		struct spa_strbuf b;
 		int i;
 
@@ -1142,8 +1142,9 @@ static int hdmi_eld_changed(snd_mixer_elem_t *melem, unsigned int mask)
 		pa_proplist_unset(p->proplist, ACP_KEY_AUDIO_POSITION_DETECTED);
 	} else {
 		uint32_t positions[eld.lpcm_channels];
-		char position[64];
-		int i = 0, pos = 0;
+		char position[eld.lpcm_channels * 8];
+		struct spa_strbuf b;
+		int i = 0;
 
 		if (eld.speakers & 0x01) {
 			positions[i++] = ACP_CHANNEL_FL;
@@ -1172,16 +1173,14 @@ static int hdmi_eld_changed(snd_mixer_elem_t *melem, unsigned int mask)
 		if (eld.speakers & 0x10) {
 			positions[i++] = ACP_CHANNEL_RC;
 		}
-
 		while (i < eld.lpcm_channels)
 			positions[i++] = ACP_CHANNEL_UNKNOWN;
 
-		for (i = 0, pos = 0; i < eld.lpcm_channels; i++) {
-			pos += snprintf(&position[pos], sizeof(position) - pos, "%s,", channel_names[positions[i]]);
-		}
-
-		/* Overwrite trailing , */
-		position[pos - 1] = 0;
+		spa_strbuf_init(&b, position, sizeof(position));
+		spa_strbuf_append(&b, "[");
+		for (i = 0; i < eld.lpcm_channels; i++)
+			spa_strbuf_append(&b, "%s%s", i ? "," : "", channel_names[positions[i]]);
+		spa_strbuf_append(&b, "]");
 
 		changed |= (old_position == NULL) || (!spa_streq(old_position, position));
 		pa_proplist_sets(p->proplist, ACP_KEY_AUDIO_POSITION_DETECTED, position);
@@ -1687,6 +1686,59 @@ static int device_disable(pa_card *impl, pa_alsa_mapping *mapping, pa_alsa_devic
 	return 0;
 }
 
+/* Synchronize IEC958 digital output/input switch states.
+ *
+ * IEC958 switches default to muted in ALSA drivers. Cards with multiple
+ * HDMI/DP outputs have indexed switches (IEC958,0 IEC958,1 etc). We enable
+ * all switches since we cannot reliably map device numbers to indices.
+ */
+static void sync_iec958_controls(pa_alsa_device *d)
+{
+	snd_mixer_t *mixer_handle;
+	snd_mixer_elem_t *elem;
+	pa_card *impl;
+	int r;
+
+	mixer_handle = d->mixer_handle;
+
+	/* Pro-audio profiles don't have per-device mixers, use card mixer */
+	if (!mixer_handle) {
+		impl = d->card;
+		if (!impl || impl->card.index == ACP_INVALID_INDEX)
+			return;
+
+		mixer_handle = pa_alsa_open_mixer(impl->ucm.mixers, impl->card.index, true);
+		if (!mixer_handle)
+			return;
+	}
+
+	/* Enable all IEC958 switches */
+	for (elem = snd_mixer_first_elem(mixer_handle); elem;
+	     elem = snd_mixer_elem_next(elem)) {
+
+		if (snd_mixer_elem_get_type(elem) != SND_MIXER_ELEM_SIMPLE)
+			continue;
+
+		const char *name = snd_mixer_selem_get_name(elem);
+		if (!name || !pa_startswith(name, "IEC958"))
+			continue;
+
+		if (snd_mixer_selem_has_playback_switch(elem)) {
+			r = snd_mixer_selem_set_playback_switch_all(elem, 1);
+			if (r < 0)
+				pa_log_warn("Failed to enable IEC958 playback switch: %s",
+				           pa_alsa_strerror(r));
+		}
+
+		if (snd_mixer_selem_has_capture_switch(elem)) {
+			r = snd_mixer_selem_set_capture_switch_all(elem, 1);
+			if (r < 0)
+				pa_log_warn("Failed to enable IEC958 capture switch: %s",
+				           pa_alsa_strerror(r));
+		}
+	}
+}
+
 static int device_enable(pa_card *impl, pa_alsa_mapping *mapping, pa_alsa_device *dev)
 {
 	const char *mod_name;
@@ -1778,6 +1830,9 @@ static int device_enable(pa_card *impl, pa_alsa_mapping *mapping, pa_alsa_device
 			break;
 	}
 
+	/* Enable IEC958 switches for digital outputs */
+	sync_iec958_controls(dev);
+
 	return 0;
 }
 
@@ -2278,6 +2333,7 @@ int acp_device_set_port(struct acp_device *dev, uint32_t port_index, uint32_t fl
 			pa_sink_suspend(s, false, PA_SUSPEND_UNAVAILABLE);
 #endif
 	}
+	sync_iec958_controls(d);
 	if (impl->events && impl->events->port_changed)
 		impl->events->port_changed(impl->user_data,
 				old ? old->port.index : 0, p->port.index);
diff --git a/spa/plugins/alsa/acp/channelmap.h b/spa/plugins/alsa/acp/channelmap.h
index 2d4b54444..2b13d2528 100644
--- a/spa/plugins/alsa/acp/channelmap.h
+++ b/spa/plugins/alsa/acp/channelmap.h
@@ -27,7 +27,11 @@
 extern "C" {
 #endif
 
+#ifdef SPA_AUDIO_MAX_CHANNELS
+#define PA_CHANNELS_MAX	((int)SPA_AUDIO_MAX_CHANNELS)
+#else
 #define PA_CHANNELS_MAX	64
+#endif
 
 #define PA_CHANNEL_MAP_SNPRINT_MAX (PA_CHANNELS_MAX * 32)
 
@@ -451,7 +455,6 @@ static inline int pa_channel_map_equal(const pa_channel_map *a, const pa_channel
 
 static inline char* pa_channel_map_snprint(char *s, size_t l, const pa_channel_map *map) {
     unsigned channel;
-    bool first = true;
     char *e;
     if (!pa_channel_map_valid(map)) {
         pa_snprintf(s, l, "%s", _("(invalid)"));
@@ -460,12 +463,10 @@ static inline char* pa_channel_map_snprint(char *s, size_t l, const pa_channel_m
     *(e = s) = 0;
     for (channel = 0; channel < map->channels && l > 1; channel++) {
         l -= pa_snprintf(e, l, "%s%s",
-                      first ? "" : ",",
+                      channel == 0 ? "" : ",",
                       pa_channel_position_to_string(map->map[channel]));
         e = strchr(e, 0);
-        first = false;
     }
-
     return s;
 }
 
diff --git a/spa/plugins/alsa/alsa-acp-device.c b/spa/plugins/alsa/alsa-acp-device.c
index 6ab41c8d2..44342a7a3 100644
--- a/spa/plugins/alsa/alsa-acp-device.c
+++ b/spa/plugins/alsa/alsa-acp-device.c
@@ -156,12 +156,13 @@ static int emit_node(struct impl *this, struct acp_device *dev)
 	const struct acp_dict_item *it;
 	uint32_t n_items, i;
 	char device_name[128], path[210], channels[16], ch[12], routes[16];
-	char card_index[16], card_name[64], *p;
+	char card_index[16], card_name[64];
 	char positions[MAX_CHANNELS * 12];
 	char codecs[512];
 	struct spa_device_object_info info;
 	struct acp_card *card = this->card;
 	const char *stream, *card_id, *bus;
+	struct spa_strbuf b;
 
 	info = SPA_DEVICE_OBJECT_INFO_INIT();
 	info.type = SPA_TYPE_INTERFACE_Node;
@@ -200,11 +201,13 @@ static int emit_node(struct impl *this, struct acp_device *dev)
 	snprintf(channels, sizeof(channels), "%d", dev->format.channels);
 	items[n_items++] = SPA_DICT_ITEM_INIT(SPA_KEY_AUDIO_CHANNELS, channels);
 
-	p = positions;
+	spa_strbuf_init(&b, positions, sizeof(positions));
+	spa_strbuf_append(&b, "[");
 	for (i = 0; i < dev->format.channels; i++) {
-		p += snprintf(p, 12, "%s%s", i == 0 ? "" : ",",
+		spa_strbuf_append(&b, "%s%s", i == 0 ? " " : ", ",
 				acp_channel_str(ch, sizeof(ch), dev->format.map[i]));
 	}
+	spa_strbuf_append(&b, " ]");
 	items[n_items++] = SPA_DICT_ITEM_INIT(SPA_KEY_AUDIO_POSITION, positions);
 
 	if (dev->n_codecs > 0) {
diff --git a/spa/plugins/alsa/alsa-pcm.c b/spa/plugins/alsa/alsa-pcm.c
index 676214685..4f2fde8b6 100644
--- a/spa/plugins/alsa/alsa-pcm.c
+++ b/spa/plugins/alsa/alsa-pcm.c
@@ -240,36 +240,33 @@ static int alsa_set_param(struct state *state, const char *k, const char *s)
 
 static int position_to_string(struct channel_map *map, char *val, size_t len)
 {
-	uint32_t i, o = 0;
+	uint32_t i;
 	char pos[8];
-	int r;
-	o += snprintf(val, len, "[ ");
+	struct spa_strbuf b;
+
+	spa_strbuf_init(&b, val, len);
+	spa_strbuf_append(&b, "[");
 	for (i = 0; i < map->n_pos; i++) {
-		r = snprintf(val+o, len-o, "%s%s", i == 0 ? "" : ", ",
+		spa_strbuf_append(&b, "%s%s", i == 0 ? " " : ", ",
 				spa_type_audio_channel_make_short_name(map->pos[i],
 					pos, sizeof(pos), "UNK"));
-		if (r < 0 || o + r >= len)
-			return -ENOSPC;
-		o += r;
 	}
-	if (len > o)
-		o += snprintf(val+o, len-o, " ]");
+	if (spa_strbuf_append(&b, " ]") < 2)
+		return -ENOSPC;
 	return 0;
 }
 
 static int uint32_array_to_string(uint32_t *vals, uint32_t n_vals, char *val, size_t len)
 {
-	uint32_t i, o = 0;
-	int r;
-	o += snprintf(val, len, "[ ");
-	for (i = 0; i < n_vals; i++) {
-		r = snprintf(val+o, len-o, "%s%d", i == 0 ? "" : ", ", vals[i]);
-		if (r < 0 || o + r >= len)
-			return -ENOSPC;
-		o += r;
-	}
-	if (len > o)
-		o += snprintf(val+o, len-o, " ]");
+	uint32_t i;
+	struct spa_strbuf b;
+
+	spa_strbuf_init(&b, val, len);
+	spa_strbuf_append(&b, "[");
+	for (i = 0; i < n_vals; i++)
+		spa_strbuf_append(&b, "%s%d", i == 0 ? " " : ", ", vals[i]);
+	if (spa_strbuf_append(&b, " ]") < 2)
+		return -ENOSPC;
 	return 0;
 }
 
@@ -776,7 +773,7 @@ static void bind_ctl_event(struct spa_source *source)
 	snd_ctl_elem_id_alloca(&bound_id);
 	snd_ctl_elem_value_alloca(&old_value);
 
-	while ((err = snd_ctl_read(state->ctl, ev) > 0)) {
+	while ((err = snd_ctl_read(state->ctl, ev)) > 0) {
 		bool changed = false;
 
 		if (snd_ctl_event_get_type(ev) != SND_CTL_EVENT_ELEM)
diff --git a/spa/plugins/audioconvert/audioconvert.c b/spa/plugins/audioconvert/audioconvert.c
index e8c95b44a..f201522f8 100644
--- a/spa/plugins/audioconvert/audioconvert.c
+++ b/spa/plugins/audioconvert/audioconvert.c
@@ -1538,8 +1538,6 @@ static int get_ramp_samples(struct impl *this, struct volume_ramp_params *vrp)
 		samples = (vrp->volume_ramp_time * vrp->rate) / 1000;
 		spa_log_info(this->log, "volume ramp samples calculated from time is %d", samples);
 	}
-	if (!samples)
-		samples = -1;
 	return samples;
 }
 
@@ -1550,12 +1548,10 @@ static int get_ramp_step_samples(struct impl *this, struct volume_ramp_params *v
 	if (vrp->volume_ramp_step_samples)
 		samples = vrp->volume_ramp_step_samples;
 	else if (vrp->volume_ramp_step_time) {
-		/* convert the step time which is in nano seconds to seconds */
-		samples = (vrp->volume_ramp_step_time/1000) * (vrp->rate/1000);
+		/* convert the step time which is in nano seconds to seconds, round up */
+		samples = SPA_MAX(1u, vrp->volume_ramp_step_time/1000) * (vrp->rate/1000);
 		spa_log_debug(this->log, "volume ramp step samples calculated from time is %d", samples);
 	}
-	if (!samples)
-		samples = -1;
 	return samples;
 }
 
@@ -1568,76 +1564,52 @@ static float get_volume_at_scale(struct volume_ramp_params *vrp, float value)
 	return 0.0;
 }
 
-static struct spa_pod *generate_ramp_up_seq(struct impl *this, struct volume_ramp_params *vrp,
+static struct spa_pod *generate_ramp_seq(struct impl *this, struct volume_ramp_params *vrp,
 		void *buffer, size_t size)
 {
 	struct spa_pod_dynamic_builder b;
 	struct spa_pod_frame f[1];
-	float start = vrp->start, end = vrp->end, volume_accum = start;
-	int ramp_samples = get_ramp_samples(this, vrp);
-	int ramp_step_samples = get_ramp_step_samples(this, vrp);
-	float volume_step = ((end - start) / (ramp_samples / ramp_step_samples));
-	uint32_t volume_offs = 0;
+	float start = vrp->start, end = vrp->end;
+	int samples = get_ramp_samples(this, vrp);
+	int step = get_ramp_step_samples(this, vrp);
+	int offs = 0;
+
+	if (samples < 0 || step < 0 || (samples > 0 && step == 0))
+		return NULL;
 
 	spa_pod_dynamic_builder_init(&b, buffer, size, 4096);
 
 	spa_pod_builder_push_sequence(&b.b, &f[0], 0);
-	spa_log_info(this->log, "generating ramp up sequence from %f to %f with a"
-		" step value %f at scale %d", start, end, volume_step, vrp->scale);
-	do {
-		float vas = get_volume_at_scale(vrp, volume_accum);
-		spa_log_trace(this->log, "volume accum %f", vas);
-		spa_pod_builder_control(&b.b, volume_offs, SPA_CONTROL_Properties);
-		spa_pod_builder_add_object(&b.b,
-				SPA_TYPE_OBJECT_Props, 0,
-				SPA_PROP_volume, SPA_POD_Float(vas));
-		volume_accum += volume_step;
-		volume_offs += ramp_step_samples;
-	} while (volume_accum < end);
-	return spa_pod_builder_pop(&b.b, &f[0]);
-}
+	spa_log_info(this->log, "generating ramp sequence from %f to %f with "
+			"step %d/%d at scale %d", start, end, step, samples, vrp->scale);
 
-static struct spa_pod *generate_ramp_down_seq(struct impl *this, struct volume_ramp_params *vrp,
-		void *buffer, size_t size)
-{
-	struct spa_pod_dynamic_builder b;
-	struct spa_pod_frame f[1];
-	int ramp_samples = get_ramp_samples(this, vrp);
-	int ramp_step_samples = get_ramp_step_samples(this, vrp);
-	float start = vrp->start, end = vrp->end, volume_accum = start;
-	float volume_step = ((start - end) / (ramp_samples / ramp_step_samples));
-	uint32_t volume_offs = 0;
+	while (1) {
+		float pos = (samples == 0) ? end :
+			SPA_CLAMP(start + (end - start) * offs / samples,
+					SPA_MIN(start, end), SPA_MAX(start, end));
+		float vas = get_volume_at_scale(vrp, pos);
 
-	spa_pod_dynamic_builder_init(&b, buffer, size, 4096);
-
-	spa_pod_builder_push_sequence(&b.b, &f[0], 0);
-	spa_log_info(this->log, "generating ramp down sequence from %f to %f with a"
-		" step value %f at scale %d", start, end, volume_step, vrp->scale);
-	do {
-		float vas = get_volume_at_scale(vrp, volume_accum);
-		spa_log_trace(this->log, "volume accum %f", vas);
-		spa_pod_builder_control(&b.b, volume_offs, SPA_CONTROL_Properties);
+		spa_log_trace(this->log, "volume %d accum %f", offs, vas);
+		spa_pod_builder_control(&b.b, offs, SPA_CONTROL_Properties);
 		spa_pod_builder_add_object(&b.b,
 				SPA_TYPE_OBJECT_Props, 0,
 				SPA_PROP_volume, SPA_POD_Float(vas));
 
-		volume_accum -= volume_step;
-		volume_offs += ramp_step_samples;
-	} while (volume_accum > end);
+		if (offs >= samples)
+			break;
+
+		offs = SPA_MIN(samples, offs + step);
+	}
+
 	return spa_pod_builder_pop(&b.b, &f[0]);
 }
 
 static void generate_volume_ramp(struct impl *this, struct volume_ramp_params *vrp,
 		void *buffer, size_t size)
 {
-	void *sequence = NULL;
-	if (vrp->start == vrp->end)
-		spa_log_error(this->log, "no change in volume, cannot ramp volume");
-	else if (vrp->end > vrp->start)
-		sequence = generate_ramp_up_seq(this, vrp, buffer, size);
-	else
-		sequence = generate_ramp_down_seq(this, vrp, buffer, size);
+	void *sequence;
 
+	sequence = generate_ramp_seq(this, vrp, buffer, size);
 	if (!sequence)
 		spa_log_error(this->log, "unable to generate sequence");
 
diff --git a/spa/plugins/audioconvert/fmt-ops.c b/spa/plugins/audioconvert/fmt-ops.c
index 3296c220b..3fc2c5f0a 100644
--- a/spa/plugins/audioconvert/fmt-ops.c
+++ b/spa/plugins/audioconvert/fmt-ops.c
@@ -551,7 +551,7 @@ int convert_init(struct convert *conv)
 	const struct dither_info *dinfo;
 	const struct noise_info *ninfo;
 	const struct clear_info *cinfo;
-	uint32_t i, conv_flags, data_size[3];
+	uint32_t i, conv_flags, data_size[4];
 
 	/* we generate int32 bits of random values. With this scale
 	 * factor, we bring this in the [-1.0, 1.0] range */
@@ -615,15 +615,17 @@ int convert_init(struct convert *conv)
 	data_size[0] = SPA_ROUND_UP(conv->noise_size * sizeof(float), FMT_OPS_MAX_ALIGN);
 	data_size[1] = SPA_ROUND_UP(RANDOM_SIZE * sizeof(uint32_t), FMT_OPS_MAX_ALIGN);
 	data_size[2] = SPA_ROUND_UP(RANDOM_SIZE * sizeof(int32_t), FMT_OPS_MAX_ALIGN);
+	data_size[3] = SPA_ROUND_UP(conv->n_channels * sizeof(struct shaper), FMT_OPS_MAX_ALIGN);
 
 	conv->data = calloc(FMT_OPS_MAX_ALIGN +
-			data_size[0] + data_size[1] + data_size[2], 1);
+			data_size[0] + data_size[1] + data_size[2] + data_size[3], 1);
 	if (conv->data == NULL)
 		return -errno;
 
 	conv->noise = SPA_PTR_ALIGN(conv->data, FMT_OPS_MAX_ALIGN, float);
 	conv->random = SPA_PTROFF(conv->noise, data_size[0], uint32_t);
 	conv->prev = SPA_PTROFF(conv->random, data_size[1], int32_t);
+	conv->shaper = SPA_PTROFF(conv->prev, data_size[2], struct shaper);
 
 	for (i = 0; i < RANDOM_SIZE; i++)
 		conv->random[i] = random();
diff --git a/spa/plugins/audioconvert/fmt-ops.h b/spa/plugins/audioconvert/fmt-ops.h
index 9f4655c22..f738e3858 100644
--- a/spa/plugins/audioconvert/fmt-ops.h
+++ b/spa/plugins/audioconvert/fmt-ops.h
@@ -236,7 +236,7 @@ struct convert {
 	uint32_t noise_size;
 	const float *ns;
 	uint32_t n_ns;
-	struct shaper shaper[64];
+	struct shaper *shaper;
 
 	void (*update_noise) (struct convert *conv, float *noise, uint32_t n_samples);
 	void (*process) (struct convert *conv, void * SPA_RESTRICT dst[], const void * SPA_RESTRICT src[],
diff --git a/spa/plugins/audioconvert/meson.build b/spa/plugins/audioconvert/meson.build
index 394bc11eb..64379c845 100644
--- a/spa/plugins/audioconvert/meson.build
+++ b/spa/plugins/audioconvert/meson.build
@@ -125,7 +125,7 @@ sparesampledumpcoeffs_sources = [
 sparesampledumpcoeffs = executable(
   'spa-resample-dump-coeffs',
   sparesampledumpcoeffs_sources,
-  c_args : [ cc_flags_native, '-DRESAMPLE_DISABLE_PRECOMP' ],
+  c_args : [ '-DRESAMPLE_DISABLE_PRECOMP' ],
   dependencies : [ spa_dep, mathlib_native ],
   install : false,
   native : true,
diff --git a/src/modules/module-echo-cancel.c b/src/modules/module-echo-cancel.c
index 997506e6f..98efa35c5 100644
--- a/src/modules/module-echo-cancel.c
+++ b/src/modules/module-echo-cancel.c
@@ -229,8 +229,10 @@ struct impl {
 	struct spa_audio_aec *aec;
 	uint32_t aec_blocksize;
 
-	unsigned int capture_ready:1;
-	unsigned int sink_ready:1;
+	struct spa_io_position *capture_position;
+	struct spa_io_position *sink_position;
+	uint32_t capture_cycle;
+	uint32_t sink_cycle;
 
 	unsigned int do_disconnect:1;
 
@@ -307,13 +309,24 @@ static void process(struct impl *impl)
 	const float *play_delayed[impl->play_info.channels];
 	float *out[impl->out_info.channels];
 	struct spa_data *dd;
-	uint32_t i, size;
-	uint32_t rindex, pindex, oindex, pdindex, avail;
+	uint32_t i;
+	uint32_t rindex, pindex, oindex, pdindex, size;
+	int32_t avail, pavail, pdavail;
 
 	size = impl->aec_blocksize;
 
-	/* First read a block from the playback and capture ring buffers */
-	spa_ringbuffer_get_read_index(&impl->rec_ring, &rindex);
+	/* First read a block from the capture ring buffer */
+	avail = spa_ringbuffer_get_read_index(&impl->rec_ring, &rindex);
+	while (avail >= (int32_t)size * 2) {
+		/* drop samples that are not needed this or next cycle. Note
+		 * that samples are kept in the ringbuffer until next cycle if
+		 * size is not equal to or divisible by quantum, to avoid
+		 * discontinuity */
+		pw_log_debug("avail %d", avail);
+		spa_ringbuffer_read_update(&impl->rec_ring, rindex + size);
+		avail = spa_ringbuffer_get_read_index(&impl->rec_ring, &rindex);
+		pw_log_debug("new avail %d, size %u", avail, size);
+	}
 
 	for (i = 0; i < impl->rec_info.channels; i++) {
 		/* captured samples, with echo from sink */
@@ -331,19 +344,34 @@ static void process(struct impl *impl)
 		out[i] = &out_buf[i][0];
 	}
 
-	spa_ringbuffer_get_read_index(&impl->play_ring, &pindex);
-	spa_ringbuffer_get_read_index(&impl->play_delayed_ring, &pdindex);
+	pavail = spa_ringbuffer_get_read_index(&impl->play_ring, &pindex);
+	pdavail = spa_ringbuffer_get_read_index(&impl->play_delayed_ring, &pdindex);
 
 	if (impl->playback != NULL && (pout = pw_stream_dequeue_buffer(impl->playback)) == NULL) {
 		pw_log_debug("out of playback buffers: %m");
 
 		/* playback stream may not yet be in streaming state, drop play
 		 * data to avoid introducing additional playback latency */
-		spa_ringbuffer_read_update(&impl->play_ring, pindex + size);
-		spa_ringbuffer_read_update(&impl->play_delayed_ring, pdindex + size);
+		spa_ringbuffer_read_update(&impl->play_ring, pindex + pavail);
+		spa_ringbuffer_read_update(&impl->play_delayed_ring, pdindex + pdavail);
 		goto done;
 	}
 
+	if (pavail > avail) {
+		/* drop too old samples from previous graph cycles */
+		pw_log_debug("pavail %d, dropping %d", pavail, pavail - avail);
+		spa_ringbuffer_read_update(&impl->play_ring, pindex + pavail - avail);
+		pavail = spa_ringbuffer_get_read_index(&impl->play_ring, &pindex);
+		pw_log_debug("new pavail %d, avail %d", pavail, avail);
+	}
+	if (pdavail > avail) {
+		/* drop too old samples from previous graph cycles */
+		pw_log_debug("pdavail %d, dropping %d", pdavail, pdavail - avail);
+		spa_ringbuffer_read_update(&impl->play_delayed_ring, pdindex + pdavail - avail);
+		pdavail = spa_ringbuffer_get_read_index(&impl->play_delayed_ring, &pdindex);
+		pw_log_debug("new pdavail %d, avail %d", pdavail, avail);
+	}
+
 	for (i = 0; i < impl->play_info.channels; i++) {
 		/* echo from sink */
 		play[i] = &play_buf[i][0];
@@ -431,7 +459,7 @@ static void process(struct impl *impl)
 	 * available on the source */
 
 	avail = spa_ringbuffer_get_read_index(&impl->out_ring, &oindex);
-	while (avail >= size) {
+	while (avail >= (int32_t)size) {
 		if ((cout = pw_stream_dequeue_buffer(impl->source)) != NULL) {
 			for (i = 0; i < impl->out_info.channels; i++) {
 				dd = &cout->buffer->datas[i];
@@ -454,8 +482,8 @@ static void process(struct impl *impl)
 	}
 
 done:
-	impl->sink_ready = false;
-	impl->capture_ready = false;
+	impl->capture_cycle = 0;
+	impl->sink_cycle = 0;
 }
 
 static void reset_buffers(struct impl *impl)
@@ -479,8 +507,8 @@ static void reset_buffers(struct impl *impl)
 	spa_ringbuffer_get_read_index(&impl->play_ring, &index);
 	spa_ringbuffer_read_update(&impl->play_ring, index + (sizeof(float) * (impl->buffer_delay)));
 
-	impl->sink_ready = false;
-	impl->capture_ready = false;
+	impl->capture_cycle = 0;
+	impl->sink_cycle = 0;
 }
 
 static void capture_destroy(void *d)
@@ -546,8 +574,11 @@ static void capture_process(void *data)
 	spa_ringbuffer_write_update(&impl->rec_ring, index + size);
 
 	if (avail + size >= impl->aec_blocksize) {
-		impl->capture_ready = true;
-		if (impl->sink_ready)
+		if (impl->capture_position)
+			impl->capture_cycle = impl->capture_position->clock.cycle;
+		else
+			pw_log_warn("no capture position");
+		if (impl->capture_cycle == impl->sink_cycle)
 			process(impl);
 	}
 
@@ -740,12 +771,26 @@ static void input_param_changed(void *data, uint32_t id, const struct spa_pod* p
 	}
 }
 
+static void capture_io_changed(void *data, uint32_t id, void *area, uint32_t size)
+{
+	struct impl *impl = data;
+
+	switch (id) {
+	case SPA_IO_Position:
+		impl->capture_position = area;
+		break;
+	default:
+		break;
+	}
+}
+
 static const struct pw_stream_events capture_events = {
 	PW_VERSION_STREAM_EVENTS,
 	.destroy = capture_destroy,
 	.state_changed = capture_state_changed,
 	.process = capture_process,
-	.param_changed = input_param_changed
+	.param_changed = input_param_changed,
+	.io_changed = capture_io_changed
 };
 
 static void source_destroy(void *d)
@@ -930,10 +975,15 @@ static void sink_process(void *data)
 				SPA_PTROFF(d->data, offs, void), size);
 	}
 	spa_ringbuffer_write_update(&impl->play_ring, index + size);
+	spa_ringbuffer_get_write_index(&impl->play_delayed_ring, &index);
+	spa_ringbuffer_write_update(&impl->play_delayed_ring, index + size);
 
 	if (avail + size >= impl->aec_blocksize) {
-		impl->sink_ready = true;
-		if (impl->capture_ready)
+		if (impl->sink_position)
+			impl->sink_cycle = impl->sink_position->clock.cycle;
+		else
+			pw_log_warn("no sink position");
+		if (impl->capture_cycle == impl->sink_cycle)
 			process(impl);
 	}
 
@@ -955,12 +1005,27 @@ static const struct pw_stream_events playback_events = {
 	.state_changed = playback_state_changed,
 	.param_changed = output_param_changed
 };
+
+static void sink_io_changed(void *data, uint32_t id, void *area, uint32_t size)
+{
+	struct impl *impl = data;
+
+	switch (id) {
+	case SPA_IO_Position:
+		impl->sink_position = area;
+		break;
+	default:
+		break;
+	}
+}
+
 static const struct pw_stream_events sink_events = {
 	PW_VERSION_STREAM_EVENTS,
 	.destroy = sink_destroy,
 	.process = sink_process,
 	.state_changed = sink_state_changed,
-	.param_changed = output_param_changed
+	.param_changed = output_param_changed,
+	.io_changed = sink_io_changed
 };
 
 #define MAX_PARAMS	512u
diff --git a/src/pipewire/properties.c b/src/pipewire/properties.c
index de81088b2..ac0aac0d0 100644
--- a/src/pipewire/properties.c
+++ b/src/pipewire/properties.c
@@ -252,7 +252,8 @@ static int update_string(struct pw_properties *props, const char *str, size_t si
 				continue;
 			}
 			/* item changed or added, apply changes later */
-			if ((errno = -add_item(&changes, key, false, val, true) < 0)) {
+			if ((res = add_item(&changes, key, false, val, true)) < 0) {
+				errno = -res;
 				it[0].state = SPA_JSON_ERROR_FLAG;
 				break;
 			}
diff --git a/src/pipewire/settings.c b/src/pipewire/settings.c
index 597e686a9..74d4cfcb2 100644
--- a/src/pipewire/settings.c
+++ b/src/pipewire/settings.c
@@ -245,24 +245,21 @@ void pw_settings_init(struct pw_context *this)
 static void expose_settings(struct pw_context *context, struct pw_impl_metadata *metadata)
 {
 	struct settings *s = &context->settings;
-	uint32_t i, o;
-	char rates[MAX_RATES*16] = "";
+	uint32_t i;
+	char rates[MAX_RATES*16];
+	struct spa_strbuf b;
 
 	pw_impl_metadata_set_propertyf(metadata,
 			PW_ID_CORE, "log.level", "", "%d", s->log_level);
 	pw_impl_metadata_set_propertyf(metadata,
 			PW_ID_CORE, "clock.rate", "", "%d", s->clock_rate);
-	for (i = 0, o = 0; i < s->n_clock_rates; i++) {
-		int r = snprintf(rates+o, sizeof(rates)-o, "%s%d", i == 0 ? "" : ", ",
+
+	spa_strbuf_init(&b, rates, sizeof(rates));
+	for (i = 0; i < s->n_clock_rates; i++)
+		spa_strbuf_append(&b, "%s%d", i == 0 ? "" : ", ",
 				s->clock_rates[i]);
-		if (r < 0 || o + r >= (int)sizeof(rates)) {
-			snprintf(rates, sizeof(rates), "%d", s->clock_rate);
-			break;
-		}
-		o += r;
-	}
 	if (s->n_clock_rates == 0)
-		snprintf(rates, sizeof(rates), "%d", s->clock_rate);
+		spa_strbuf_append(&b, "%d", s->clock_rate);
 
 	pw_impl_metadata_set_propertyf(metadata,
 			PW_ID_CORE, "clock.allowed-rates", "", "[ %s ]", rates);
diff --git a/test/meson.build b/test/meson.build
index ad658bcc6..5e38db383 100644
--- a/test/meson.build
+++ b/test/meson.build
@@ -112,6 +112,7 @@ test('test-spa',
     executable('test-spa',
                'test-spa-buffer.c',
                'test-spa-control.c',
+               'test-spa-format.c',
                'test-spa-json.c',
                'test-spa-utils.c',
                'test-spa-log.c',
diff --git a/test/test-spa-format.c b/test/test-spa-format.c
new file mode 100644
index 000000000..7cbec7690
--- /dev/null
+++ b/test/test-spa-format.c
@@ -0,0 +1,129 @@
+/* Simple Plugin API */
+/* SPDX-FileCopyrightText: Copyright © 2025 Pauli Virtanen */
+/* SPDX-License-Identifier: MIT */
+
+#include <spa/param/audio/format-utils.h>
+#include <spa/param/audio/format.h>
+
+#include "pwtest.h"
+
+PWTEST(audio_format_sizes)
+{
+	union {
+		uint8_t buf[1024];
+		struct spa_audio_info align;
+	} data;
+	struct spa_audio_info info;
+	size_t i;
+
+	memset(&info, 0xf3, sizeof(info));
+	info.media_type = SPA_MEDIA_TYPE_audio;
+	info.media_subtype = SPA_MEDIA_SUBTYPE_raw;
+	info.info.raw.channels = 5;
+	info.info.raw.format = SPA_AUDIO_FORMAT_F32P;
+	info.info.raw.rate = 12345;
+	info.info.raw.flags = 0;
+	info.info.raw.position[0] = 1;
+	info.info.raw.position[1] = 2;
+	info.info.raw.position[2] = 3;
+	info.info.raw.position[3] = 4;
+	info.info.raw.position[4] = 5;
+
+	for (i = 0; i < sizeof(data.buf); ++i) {
+		struct spa_pod *pod;
+		uint8_t buf[4096];
+		struct spa_pod_builder b;
+
+		spa_pod_builder_init(&b, buf, sizeof(buf));
+		memcpy(data.buf, &info, sizeof(info));
+
+		pod = spa_format_audio_ext_build(&b, 123, (void *)data.buf, i);
+		if (i < offsetof(struct spa_audio_info, info.raw)
+				+ offsetof(struct spa_audio_info_raw, position))
+			pwtest_bool_true(!pod);
+		else
+			pwtest_bool_true(pod);
+	}
+
+	for (i = 0; i < sizeof(data.buf); ++i) {
+		struct spa_pod *pod;
+		uint8_t buf[4096];
+		struct spa_pod_builder b;
+		int ret;
+
+		spa_pod_builder_init(&b, buf, sizeof(buf));
+		pod = spa_format_audio_ext_build(&b, 123, &info, sizeof(info));
+		pwtest_bool_true(pod);
+
+		memset(data.buf, 0xf3, sizeof(data.buf));
+
+		ret = spa_format_audio_ext_parse(pod, (void *)data.buf, i);
+		if (i < offsetof(struct spa_audio_info, info.raw)
+				+ offsetof(struct spa_audio_info_raw, position)
+				+ info.info.raw.channels*sizeof(uint32_t)) {
+			for (size_t j = i; j < sizeof(data.buf); ++j)
+				pwtest_int_eq(data.buf[j], 0xf3);
+			pwtest_int_lt(ret, 0);
+		} else {
+			pwtest_int_ge(ret, 0);
+			pwtest_bool_true(memcmp(data.buf, &info, SPA_MIN(i, sizeof(info))) == 0);
+		}
+	}
+
+	memset(&info, 0xf3, sizeof(info));
+	info.media_type = SPA_MEDIA_TYPE_audio;
+	info.media_subtype = SPA_MEDIA_SUBTYPE_aac;
+	info.info.aac.rate = 12345;
+	info.info.aac.channels = 6;
+	info.info.aac.bitrate = 54321;
+	info.info.aac.stream_format = SPA_AUDIO_AAC_STREAM_FORMAT_MP4LATM;
+
+	for (i = 0; i < sizeof(data.buf); ++i) {
+		struct spa_pod *pod;
+		uint8_t buf[4096];
+		struct spa_pod_builder b;
+
+		spa_pod_builder_init(&b, buf, sizeof(buf));
+		memcpy(data.buf, &info, sizeof(info));
+
+		pod = spa_format_audio_ext_build(&b, 123, (void *)data.buf, i);
+		if (i < offsetof(struct spa_audio_info, info.raw)
+				+ sizeof(struct spa_audio_info_aac))
+			pwtest_bool_true(!pod);
+		else
+			pwtest_bool_true(pod);
+	}
+
+	for (i = 0; i < sizeof(data.buf); ++i) {
+		struct spa_pod *pod;
+		uint8_t buf[4096];
+		struct spa_pod_builder b;
+		int ret;
+
+		spa_pod_builder_init(&b, buf, sizeof(buf));
+		pod = spa_format_audio_ext_build(&b, 123, &info, sizeof(info));
+		pwtest_bool_true(pod);
+
+		memset(data.buf, 0xf3, sizeof(data.buf));
+
+		ret = spa_format_audio_ext_parse(pod, (void *)data.buf, i);
+		if (i < offsetof(struct spa_audio_info, info.raw)
+				+ sizeof(struct spa_audio_info_aac)) {
+			for (size_t j = i; j < sizeof(data.buf); ++j)
+				pwtest_int_eq(data.buf[j], 0xf3);
+			pwtest_int_lt(ret, 0);
+		} else {
+			pwtest_int_ge(ret, 0);
+			pwtest_bool_true(memcmp(data.buf, &info, SPA_MIN(i, sizeof(info))) == 0);
+		}
+	}
+
+	return PWTEST_PASS;
+}
+
+PWTEST_SUITE(spa_format)
+{
+	pwtest_add(audio_format_sizes, PWTEST_NOARG);
+
+	return PWTEST_PASS;
+}
diff --git a/test/test-spa-json.c b/test/test-spa-json.c
index 66ef2eeac..0c3c46f59 100644
--- a/test/test-spa-json.c
+++ b/test/test-spa-json.c
@@ -609,7 +609,7 @@ static void test_array(const char *str, const char * const vals[])
 
 	spa_json_init(&it[0], str, strlen(str));
 	if (spa_json_enter_array(&it[0], &it[1]) <= 0)
-		spa_json_init(&it[1], str, strlen(str));
+		spa_json_init_relax(&it[1], '[', str, strlen(str));
 	for (i = 0; vals[i]; i++) {
 		pwtest_int_gt(spa_json_get_string(&it[1], val, sizeof(val)), 0);
 		pwtest_str_eq(val, vals[i]);
@@ -624,6 +624,7 @@ PWTEST(json_array)
 	test_array("[FL FR]", (const char *[]){ "FL", "FR", NULL });
 	test_array("FL FR", (const char *[]){ "FL", "FR", NULL });
 	test_array("[ FL FR ]", (const char *[]){ "FL", "FR", NULL });
+	test_array("FL FR FC", (const char *[]){ "FL", "FR", "FC", NULL });
 
 	return PWTEST_PASS;
 }