diff --git a/core/hif/inc/hif.h b/core/hif/inc/hif.h
index aa0b605..dd2c898 100644
--- a/core/hif/inc/hif.h
+++ b/core/hif/inc/hif.h
@@ -85,7 +85,11 @@
 #define TARGET_TYPE_ADRASTEA     16
 
 struct CE_state;
+#ifdef QCA_WIFI_3_0_ADRASTEA
+#define CE_COUNT_MAX 12
+#else
 #define CE_COUNT_MAX 8
+#endif
 
 /* These numbers are selected so that the product is close to current
    higher limit of packets HIF services at one shot (1000) */
diff --git a/core/hif/src/adrastea_reg_def.h b/core/hif/src/adrastea_reg_def.h
index 743d22e..a87884a 100644
--- a/core/hif/src/adrastea_reg_def.h
+++ b/core/hif/src/adrastea_reg_def.h
@@ -2159,7 +2159,7 @@
 	.d_SOC_PCIE_BASE_ADDRESS = SOC_PCIE_BASE_ADDRESS,
 	.d_MSI_MAGIC_ADR_ADDRESS = MSI_MAGIC_ADR_ADDRESS,
 	.d_MSI_MAGIC_ADDRESS = MSI_MAGIC_ADDRESS,
-	.d_HOST_CE_COUNT = 8,
+	.d_HOST_CE_COUNT = ADRASTEA_CE_COUNT,
 	.d_ENABLE_MSI = 0,
 	.d_MUX_ID_MASK = 0xf000,
 	.d_TRANSACTION_ID_MASK = 0x0fff,
diff --git a/core/hif/src/ce/ce_assignment.h b/core/hif/src/ce/ce_assignment.h
index b493d55..9ff907f 100644
--- a/core/hif/src/ce/ce_assignment.h
+++ b/core/hif/src/ce/ce_assignment.h
@@ -92,6 +92,12 @@
 	/* ce_diag, the Diagnostic Window */
 	{ /* CE7 */ (CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR), 0,
 		2, DIAG_TRANSFER_LIMIT, 2, NULL,},
+	/* Target to uMC */
+	{ /* CE8 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
+	/*The following CEs are not being used yet */
+	{ /* CE9 */ CE_ATTR_FLAGS, 0, 0,  0, 0, NULL,},
+	{ /* CE10 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
+	{ /* CE11 */ CE_ATTR_FLAGS, 0, 0, 0, 0, NULL,},
 };
 
 static struct CE_pipe_config target_ce_config_wlan[] = {
@@ -116,7 +122,11 @@
 	{ /* CE7 */ 7, PIPEDIR_INOUT_H2H, 0, 0,
 		(CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR), 0,},
 	/* CE8 used only by IPA */
-	{ /* CE8 */ 8, PIPEDIR_IN, 32, 2048, CE_ATTR_FLAGS, 0,}
+	{ /* CE8 */ 8, PIPEDIR_IN, 32, 2048, CE_ATTR_FLAGS, 0,},
+	/*The following CEs are not being used yet*/
+	{ /* CE9 */ 9, PIPEDIR_IN,  0, 0, CE_ATTR_FLAGS, 0,},
+	{ /* CE10 */ 9, PIPEDIR_IN,  0, 0, CE_ATTR_FLAGS, 0,},
+	{ /* CE11 */ 9, PIPEDIR_IN,  0, 0, CE_ATTR_FLAGS, 0,},
 };
 
 static struct CE_attr host_ce_config_wlan_epping_poll[] = {
diff --git a/core/hif/src/ce/ce_service.c b/core/hif/src/ce/ce_service.c
index a898d0b..4b6c37b 100644
--- a/core/hif/src/ce/ce_service.c
+++ b/core/hif/src/ce/ce_service.c
@@ -1509,6 +1509,10 @@
 {
 	struct CE_state *CE_state = (struct CE_state *)copyeng;
 
+	if (CE_state == NULL) {
+		pr_err("%s: Error CE state = NULL\n", __func__);
+		return;
+	}
 	cdf_spin_lock(&CE_state->scn->target_lock);
 	CE_state->send_cb = fn_ptr;
 	CE_state->send_context = ce_send_context;
@@ -1523,6 +1527,10 @@
 {
 	struct CE_state *CE_state = (struct CE_state *)copyeng;
 
+	if (CE_state == NULL) {
+		pr_err("%s: ERROR CE state = NULL\n", __func__);
+		return;
+	}
 	cdf_spin_lock(&CE_state->scn->target_lock);
 	CE_state->recv_cb = fn_ptr;
 	CE_state->recv_context = CE_recv_context;