diff --git a/ChangeLog b/ChangeLog
index ce3f25ce8..f456e1978 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,37 @@
-# 2025-XX-XX Version 3.XX.X
+# 2025-09-01 Version 3.17.1
+
+Minor improvements and bugfix release.
+
+* most notably a memory leak was addressed
+* fixed header files missing C++ guards
+* xfreerdp as well as the SDL clients now support a system wide configuration file
+* Heimdal kerberos support was improved
+* builds with [MS-RDPEAR] now properly abort at configure if Heimdal is used
+  (this configuration was never supported, so ensure nobody compiles it that way)
+
+## What's Changed
+* [client,sdl] always set sdl->windows_created (#11807)
+* [winpr,synch] increase timeout for TestSynchCritical (#11808)
+* Enable RDPECAM client in flatpak release (#11809)
+* [proxy,channels] refactor dynamic channel (#11812)
+* [core,settings] fix ReceivedCapabilities reset (#11814)
+* Freebsd build fixes (#11815)
+* [client,sdl] disable connection dialog (#11820)
+* audin_oss: do not reset mic volume on capture start (#11822)
+* add-x11-config-file (#11823)
+* [client,sdl] fix global config evaluation (#11825)
+* [sspi,negotiate] improve /auth-pkg-list parsing (#11826)
+* Geometry channel fixes (#)11828)
+* core/redirection: Ensure stream has enough space for all parameters (#11830)
 
 ## New Contributors
 * @omatasas made their first contribution in #11787
+* @sharkcz made their first contribution in #11808
+* @cvpcs made their first contribution in #11809
+* @Defenso-QTH made their first contribution in #11822
+
+For a complete and detailed change log since the last release run:
+git log 3.17.1...3.17.0
 
 # 2025-08-22 Version 3.17.0
 
diff --git a/client/common/test/TestClientRdpFile.c b/client/common/test/TestClientRdpFile.c
index ff4eb143e..15c1186cf 100644
--- a/client/common/test/TestClientRdpFile.c
+++ b/client/common/test/TestClientRdpFile.c
@@ -288,7 +288,7 @@ static void* read_rdp_data(const char* name, size_t* plen)
 	if (fseek(fp, 0, SEEK_SET) != 0)
 		goto fail;
 
-	json = calloc(pos + 1ULL, sizeof(char));
+	json = calloc(1ULL + pos, sizeof(char));
 	if (!json)
 		goto fail;
 	if (fread(json, 1, pos, fp) != pos)
diff --git a/cmake/GetProjectVersion.cmake b/cmake/GetProjectVersion.cmake
index 935b01ca4..ff424fb25 100644
--- a/cmake/GetProjectVersion.cmake
+++ b/cmake/GetProjectVersion.cmake
@@ -4,7 +4,7 @@ option(USE_GIT_FOR_REVISION "Extract git tag/commit" OFF)
 function(get_project_version VERSION_MAJOR VERSION_MINOR VERSION_REVISION VERSION_SUFFIX GIT_REVISION)
 
   # Default version, hard codec per release
-  set(RAW_VERSION_STRING "3.17.1-dev0")
+  set(RAW_VERSION_STRING "3.17.2-dev0")
 
   set(VERSION_REGEX "^(.*)([0-9]+)\\.([0-9]+)\\.([0-9]+)-?(.*)")
 
diff --git a/libfreerdp/core/childsession.c b/libfreerdp/core/childsession.c
index 51973d5d8..bcc58e364 100644
--- a/libfreerdp/core/childsession.c
+++ b/libfreerdp/core/childsession.c
@@ -256,7 +256,11 @@ static int transport_bio_named_puts(BIO* bio, const char* str)
 	WINPR_ASSERT(bio);
 	WINPR_ASSERT(str);
 
-	return transport_bio_named_write(bio, str, (int)strnlen(str, INT32_MAX));
+	const int max = (INT_MAX > SIZE_MAX) ? SIZE_MAX : INT_MAX;
+	const size_t len = strnlen(str, max);
+	if (len >= max)
+		return -1;
+	return transport_bio_named_write(bio, str, WINPR_ASSERTING_INT_CAST(int, len));
 }
 
 static int transport_bio_named_gets(BIO* bio, char* str, int size)
diff --git a/libfreerdp/core/gateway/tsg.c b/libfreerdp/core/gateway/tsg.c
index 85640f820..dbfdf77bf 100644
--- a/libfreerdp/core/gateway/tsg.c
+++ b/libfreerdp/core/gateway/tsg.c
@@ -2961,7 +2961,7 @@ static int transport_bio_tsg_puts(BIO* bio, const char* str)
 {
 	WINPR_UNUSED(bio);
 	WINPR_UNUSED(str);
-	return 1;
+	return -2;
 }
 
 // NOLINTNEXTLINE(readability-non-const-parameter)
diff --git a/libfreerdp/core/tcp.c b/libfreerdp/core/tcp.c
index 456ba84b6..f76081daa 100644
--- a/libfreerdp/core/tcp.c
+++ b/libfreerdp/core/tcp.c
@@ -174,7 +174,7 @@ static int transport_bio_simple_read(BIO* bio, char* buf, int size)
 
 static int transport_bio_simple_puts(WINPR_ATTR_UNUSED BIO* bio, WINPR_ATTR_UNUSED const char* str)
 {
-	return 1;
+	return -2;
 }
 
 static int transport_bio_simple_gets(WINPR_ATTR_UNUSED BIO* bio, WINPR_ATTR_UNUSED char* str,
diff --git a/libfreerdp/core/transport.c b/libfreerdp/core/transport.c
index 4ccdb37dd..b3ab34e82 100644
--- a/libfreerdp/core/transport.c
+++ b/libfreerdp/core/transport.c
@@ -2012,7 +2012,7 @@ static int transport_layer_bio_read(BIO* bio, char* buf, int size)
 
 static int transport_layer_bio_puts(WINPR_ATTR_UNUSED BIO* bio, WINPR_ATTR_UNUSED const char* str)
 {
-	return 1;
+	return -2;
 }
 
 static int transport_layer_bio_gets(WINPR_ATTR_UNUSED BIO* bio, WINPR_ATTR_UNUSED char* str,
diff --git a/libfreerdp/crypto/tls.c b/libfreerdp/crypto/tls.c
index 997c7c4c1..683385a2e 100644
--- a/libfreerdp/crypto/tls.c
+++ b/libfreerdp/crypto/tls.c
@@ -251,8 +251,9 @@ static int bio_rdp_tls_puts(BIO* bio, const char* str)
 	if (!str)
 		return 0;
 
-	const size_t size = strnlen(str, INT_MAX + 1UL);
-	if (size > INT_MAX)
+	const int max = (INT_MAX > SIZE_MAX) ? SIZE_MAX : INT_MAX;
+	const size_t size = strnlen(str, max);
+	if (size >= max)
 		return -1;
 	ERR_clear_error();
 	return BIO_write(bio, str, (int)size);
diff --git a/server/proxy/channels/pf_channel_drdynvc.c b/server/proxy/channels/pf_channel_drdynvc.c
index 79621c533..20e9b26d8 100644
--- a/server/proxy/channels/pf_channel_drdynvc.c
+++ b/server/proxy/channels/pf_channel_drdynvc.c
@@ -437,7 +437,7 @@ static PfChannelResult DynvcTrackerHandleCreateFront(ChannelStateTracker* tracke
                                                      WINPR_ATTR_UNUSED proxyData* pdata,
                                                      pServerDynamicChannelContext* dynChannel,
                                                      DynChannelContext* dynChannelContext,
-                                                     UINT64 dynChannelId)
+                                                     WINPR_ATTR_UNUSED UINT64 dynChannelId)
 {
 	const BOOL isBackData = (tracker == dynChannelContext->backTracker);
 	const BYTE cmd = CREATE_REQUEST_PDU;
diff --git a/winpr/libwinpr/file/test/TestFileFindFirstFile.c b/winpr/libwinpr/file/test/TestFileFindFirstFile.c
index 049b6ba4b..a0776132b 100644
--- a/winpr/libwinpr/file/test/TestFileFindFirstFile.c
+++ b/winpr/libwinpr/file/test/TestFileFindFirstFile.c
@@ -10,6 +10,16 @@
 
 static const CHAR testFile1A[] = "TestFile1A";
 
+static BOOL create_file(const char* FilePath)
+{
+	HANDLE hdl =
+	    CreateFileA(FilePath, GENERIC_ALL, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+	if (hdl == INVALID_HANDLE_VALUE)
+		return FALSE;
+	(void)CloseHandle(hdl);
+	return TRUE;
+}
+
 static BOOL create_layout_files(size_t level, const char* BasePath, wArrayList* files)
 {
 	for (size_t x = 0; x < 10; x++)
@@ -21,12 +31,8 @@ static BOOL create_layout_files(size_t level, const char* BasePath, wArrayList*
 		(void)_snprintf(name, ARRAYSIZE(name), "%zd-TestFile%zd", level, x);
 		NativePathCchAppendA(FilePath, PATHCCH_MAX_CCH, name);
 
-		HANDLE hdl =
-		    CreateFileA(FilePath, GENERIC_ALL, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
-		if (hdl == INVALID_HANDLE_VALUE)
-			return FALSE;
-		ArrayList_Append(files, FilePath);
-		(void)CloseHandle(hdl);
+		if (create_file(FilePath))
+			ArrayList_Append(files, FilePath);
 	}
 	return TRUE;
 }
@@ -276,6 +282,9 @@ static int TestFileFindFirstFileW(const char* str)
 
 	CHAR FilePathA[PATHCCH_MAX_CCH] = { 0 };
 	(void)ConvertWCharNToUtf8(FilePath, ARRAYSIZE(FilePath), FilePathA, ARRAYSIZE(FilePathA));
+	if (!create_file(FilePathA))
+		return -1;
+
 	printf("Finding file: %s\n", FilePathA);
 
 	WIN32_FIND_DATAW FindData = { 0 };
@@ -319,7 +328,7 @@ int TestFileFindFirstFile(int argc, char* argv[])
 	if (winpr_PathMakePath(str, NULL))
 	{
 		rc1 = TestFileFindFirstFileA(str);
-		rc2 = 0; // TestFileFindFirstFileW(str);
+		rc2 = TestFileFindFirstFileW(str);
 		winpr_RemoveDirectory(str);
 	}
 	free(str);