diff --git a/armsrc/appmain.c b/armsrc/appmain.c
index e5af92dd4..1aabc302e 100644
--- a/armsrc/appmain.c
+++ b/armsrc/appmain.c
@@ -1476,13 +1476,19 @@ static void PacketReceived(PacketCommandNG *packet) {
             break;
         }
         case CMD_LF_PCF7931_WRITE: {
+            if (packet->length != sizeof(pcf7931_write_t)) {
+                reply_ng(CMD_LF_PCF7931_WRITE, PM3_EINVARG, NULL, 0);
+                break;
+            }
+            pcf7931_write_t *payload = (pcf7931_write_t *)packet->data.asBytes;
             WritePCF7931(
-                packet->data.asBytes[0], packet->data.asBytes[1], packet->data.asBytes[2], packet->data.asBytes[3],
-                packet->data.asBytes[4], packet->data.asBytes[5], packet->data.asBytes[6], packet->data.asBytes[9],
-                packet->data.asBytes[7] - 128, packet->data.asBytes[8] - 128,
-                packet->oldarg[0],
-                packet->oldarg[1],
-                packet->oldarg[2],
+                payload->pwd[0], payload->pwd[1], payload->pwd[2], payload->pwd[3],
+                payload->pwd[4], payload->pwd[5], payload->pwd[6],
+                payload->init_delay,
+                payload->offset_width - 128, payload->offset_position - 128,
+                payload->address,
+                payload->byte,
+                payload->data,
                 true
             );
             break;
@@ -1598,7 +1604,12 @@ static void PacketReceived(PacketCommandNG *packet) {
             break;
         }
         case CMD_LF_HITAGS_SIMULATE: { // Simulate Hitag s tag, args = memory content
-            hts_simulate((bool)packet->oldarg[0], packet->oldarg[1], packet->data.asBytes, true);
+            if (packet->length < sizeof(hitag_sim_t)) {
+                reply_ng(CMD_LF_HITAGS_SIMULATE, PM3_EINVARG, NULL, 0);
+                break;
+            }
+            hitag_sim_t *payload = (hitag_sim_t *)packet->data.asBytes;
+            hts_simulate((bool)payload->tag_mem_supplied, payload->threshold, payload->data, true);
             break;
         }
         case CMD_LF_HITAGS_TEST_TRACES: { // Tests every challenge within the given file
@@ -1642,7 +1653,12 @@ static void PacketReceived(PacketCommandNG *packet) {
             break;
         }
         case CMD_LF_HITAGU_SIMULATE: {
-            htu_simulate((bool)packet->oldarg[0], packet->oldarg[1], packet->data.asBytes, true);
+            if (packet->length < sizeof(hitag_sim_t)) {
+                reply_ng(CMD_LF_HITAGU_SIMULATE, PM3_EINVARG, NULL, 0);
+                break;
+            }
+            hitag_sim_t *payload = (hitag_sim_t *)packet->data.asBytes;
+            htu_simulate((bool)payload->tag_mem_supplied, payload->threshold, payload->data, true);
             break;
         }
         case CMD_LF_HITAGU_UID: {
@@ -2591,7 +2607,12 @@ static void PacketReceived(PacketCommandNG *packet) {
             break;
         }
         case CMD_HF_MFU_OTP_TEAROFF: {
-            MifareU_Otp_Tearoff(packet->oldarg[0], packet->oldarg[1], packet->data.asBytes);
+            if (packet->length < sizeof(mfu_otp_tearoff_t)) {
+                reply_ng(CMD_HF_MFU_OTP_TEAROFF, PM3_EINVARG, NULL, 0);
+                break;
+            }
+            mfu_otp_tearoff_t *payload = (mfu_otp_tearoff_t *)packet->data.asBytes;
+            MifareU_Otp_Tearoff(payload->blockno, payload->tearoff_time, payload->data);
             break;
         }
         case CMD_HF_MFU_COUNTER_TEAROFF: {
@@ -3407,8 +3428,14 @@ static void PacketReceived(PacketCommandNG *packet) {
         }
         case CMD_FLASHMEM_WIPE: {
             LED_B_ON();
-            uint8_t page = packet->oldarg[0];
-            uint8_t initialwipe = packet->oldarg[1];
+            if (packet->length != sizeof(flashmem_wipe_t)) {
+                reply_ng(CMD_FLASHMEM_WIPE, PM3_EINVARG, NULL, 0);
+                LED_B_OFF();
+                break;
+            }
+            flashmem_wipe_t *wpayload = (flashmem_wipe_t *)packet->data.asBytes;
+            uint8_t page = wpayload->page;
+            uint8_t initialwipe = wpayload->initialwipe;
 
             bool isok = false;
             if (initialwipe) {
@@ -3606,7 +3633,10 @@ static void PacketReceived(PacketCommandNG *packet) {
             break;
         }
         case CMD_LCD: {
-            LCDSend(packet->oldarg[0]);
+            if (packet->length != sizeof(lcd_cmd_t)) {
+                break;
+            }
+            LCDSend(((lcd_cmd_t *)packet->data.asBytes)->cmd);
             break;
         }
 #endif
diff --git a/armsrc/pcf7931.c b/armsrc/pcf7931.c
index d7a7a75cd..aea852e34 100644
--- a/armsrc/pcf7931.c
+++ b/armsrc/pcf7931.c
@@ -427,7 +427,7 @@ end:
         }
     */
 
-    reply_mix(CMD_ACK, 0, 0, 0, 0, 0);
+    reply_ng(CMD_LF_PCF7931_WRITE, PM3_SUCCESS, NULL, 0);
 }
 
 static void RealWritePCF7931(
diff --git a/client/src/cmdflashmem.c b/client/src/cmdflashmem.c
index 53e20810b..de72bfc6a 100644
--- a/client/src/cmdflashmem.c
+++ b/client/src/cmdflashmem.c
@@ -645,7 +645,11 @@ static int CmdFlashMemWipe(const char *Cmd) {
     }
 
     clearCommandBuffer();
-    SendCommandMIX(CMD_FLASHMEM_WIPE, page, initialwipe, 0, NULL, 0);
+    flashmem_wipe_t payload = {
+        .page = page,
+        .initialwipe = initialwipe,
+    };
+    SendCommandNG(CMD_FLASHMEM_WIPE, (uint8_t *)&payload, sizeof(payload));
     PacketResponseNG resp;
     if (WaitForResponseTimeout(CMD_FLASHMEM_WIPE, &resp, 10000) == false) {
         PrintAndLogEx(WARNING, "timeout while waiting for reply");
diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c
index 8688d8bc2..43d1c7c94 100644
--- a/client/src/cmdhfmfu.c
+++ b/client/src/cmdhfmfu.c
@@ -6508,7 +6508,12 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) {
         memcpy(post, resp.data.asBytes, sizeof(post));
 
         clearCommandBuffer();
-        SendCommandMIX(CMD_HF_MFU_OTP_TEAROFF, blockno, current, 0, teardata, sizeof(teardata));
+        uint8_t tbuf[sizeof(mfu_otp_tearoff_t) + sizeof(teardata)] = {0};
+        mfu_otp_tearoff_t *tpayload = (mfu_otp_tearoff_t *)tbuf;
+        tpayload->blockno = blockno;
+        tpayload->tearoff_time = current;
+        memcpy(tpayload->data, teardata, sizeof(teardata));
+        SendCommandNG(CMD_HF_MFU_OTP_TEAROFF, tbuf, sizeof(tbuf));
 
         // we be getting ACK that we are silently ignoring here..
 
diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index e495e61f6..6380d68f2 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -658,7 +658,8 @@ static int CmdLCD(const char *Cmd) {
 
     while (j--) {
         clearCommandBuffer();
-        SendCommandMIX(CMD_LCD, raw[0], 0, 0, NULL, 0);
+        lcd_cmd_t payload = { .cmd = raw[0] };
+        SendCommandNG(CMD_LCD, (uint8_t *)&payload, sizeof(payload));
     }
     return PM3_SUCCESS;
 }
diff --git a/client/src/cmdlfhitaghts.c b/client/src/cmdlfhitaghts.c
index 55c233f5b..96f5880a8 100644
--- a/client/src/cmdlfhitaghts.c
+++ b/client/src/cmdlfhitaghts.c
@@ -1005,7 +1005,11 @@ static int CmdLFHitagSSim(const char *Cmd) {
     CLIParserFree(ctx);
 
     clearCommandBuffer();
-    SendCommandMIX(CMD_LF_HITAGS_SIMULATE, false, threshold, 0, NULL, 0);
+    hitag_sim_t payload = {
+        .tag_mem_supplied = false,
+        .threshold = threshold,
+    };
+    SendCommandNG(CMD_LF_HITAGS_SIMULATE, (uint8_t *)&payload, sizeof(payload));
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/cmdlfhitagu.c b/client/src/cmdlfhitagu.c
index 59e72aebe..a4a338471 100644
--- a/client/src/cmdlfhitagu.c
+++ b/client/src/cmdlfhitagu.c
@@ -703,7 +703,11 @@ static int CmdLFHitagUSim(const char *Cmd) {
     CLIParserFree(ctx);
 
     clearCommandBuffer();
-    SendCommandMIX(CMD_LF_HITAGU_SIMULATE, false, threshold, 0, NULL, 0);
+    hitag_sim_t payload = {
+        .tag_mem_supplied = false,
+        .threshold = threshold,
+    };
+    SendCommandNG(CMD_LF_HITAGU_SIMULATE, (uint8_t *)&payload, sizeof(payload));
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/cmdlfpcf7931.c b/client/src/cmdlfpcf7931.c
index df18617dc..dafbc7ab6 100644
--- a/client/src/cmdlfpcf7931.c
+++ b/client/src/cmdlfpcf7931.c
@@ -184,14 +184,24 @@ static int CmdLFPCF7931Write(const char *Cmd) {
 
     PrintAndLogEx(INFO, "Writing block %u at idx %u with data 0x%02X", block, idx, data[0]);
 
-    uint32_t buf[10]; // TODO sparse struct, 7 *bytes* then words at offset 4*7!
-    memcpy(buf, configPcf.Pwd, sizeof(configPcf.Pwd));
-    buf[7] = (configPcf.OffsetWidth + 128);
-    buf[8] = (configPcf.OffsetPosition + 128);
-    buf[9] = configPcf.InitDelay;
+    pcf7931_write_t payload = {
+        .offset_width = (uint8_t)(configPcf.OffsetWidth + 128),
+        .offset_position = (uint8_t)(configPcf.OffsetPosition + 128),
+        .init_delay = configPcf.InitDelay,
+        .address = block,
+        .byte = idx,
+        .data = data[0],
+    };
+    memcpy(payload.pwd, configPcf.Pwd, sizeof(payload.pwd));
 
     clearCommandBuffer();
-    SendCommandMIX(CMD_LF_PCF7931_WRITE, block, idx, data[0], buf, sizeof(buf));
+    SendCommandNG(CMD_LF_PCF7931_WRITE, (uint8_t *)&payload, sizeof(payload));
+
+    PacketResponseNG resp;
+    if (WaitForResponseTimeout(CMD_LF_PCF7931_WRITE, &resp, 4000) == false) {
+        PrintAndLogEx(WARNING, "timeout while waiting for reply");
+        return PM3_ETIMEOUT;
+    }
 
     PrintAndLogEx(SUCCESS, "Done!");
     PrintAndLogEx(HINT, "Hint: Try " _YELLOW_("`lf pcf7931 reader`") " to verify");
diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h
index 5172cd7e9..839d73796 100644
--- a/include/pm3_cmd.h
+++ b/include/pm3_cmd.h
@@ -417,6 +417,47 @@ typedef struct {
     uint32_t timings[];
 } epa_result_t;
 
+// CMD_LF_PCF7931_WRITE payload.
+// Replaces a uint32_t buf[10] that the device read as BYTES: the client wrote
+// OffsetWidth/OffsetPosition/InitDelay at byte offsets 28/32/36 while the device
+// read bytes 7/8/9, so those three were uninitialised stack on arrival.
+typedef struct {
+    uint8_t pwd[7];
+    uint8_t offset_width;       // biased by +128
+    uint8_t offset_position;    // biased by +128
+    uint16_t init_delay;
+    uint8_t address;
+    uint8_t byte;
+    uint8_t data;
+} PACKED pcf7931_write_t;
+
+// CMD_LF_HITAGS_SIMULATE / CMD_LF_HITAGU_SIMULATE payload
+typedef struct {
+    uint8_t tag_mem_supplied;
+    uint8_t rfu;
+    uint16_t threshold;
+    uint8_t data[];
+} PACKED hitag_sim_t;
+
+// CMD_HF_MFU_OTP_TEAROFF payload
+typedef struct {
+    uint8_t blockno;
+    uint8_t rfu;
+    uint16_t tearoff_time;
+    uint8_t data[];
+} PACKED mfu_otp_tearoff_t;
+
+// CMD_FLASHMEM_WIPE payload
+typedef struct {
+    uint8_t page;
+    uint8_t initialwipe;
+} PACKED flashmem_wipe_t;
+
+// CMD_LCD payload
+typedef struct {
+    uint32_t cmd;
+} PACKED lcd_cmd_t;
+
 // CMD_HF_MIFARE_READSC payload
 typedef struct {
     uint8_t sectorno;