diff --git a/examples/drivers/windows/otLwf/filter.c b/examples/drivers/windows/otLwf/filter.c
index 0a99e3d96..25d32fd17 100644
--- a/examples/drivers/windows/otLwf/filter.c
+++ b/examples/drivers/windows/otLwf/filter.c
@@ -471,7 +471,7 @@ Return Value:
     }
 
     // Query the device capabilities
-    NtStatus = otLwfCmdGetProp(pFilter, SpinelCapsDataBuffer, SPINEL_PROP_CAPS, SPINEL_DATATYPE_DATA_S, &SpinelCapsPtr, &SpinelCapsLen);
+    NtStatus = otLwfCmdGetProp(pFilter, &SpinelCapsDataBuffer, SPINEL_PROP_CAPS, SPINEL_DATATYPE_DATA_S, &SpinelCapsPtr, &SpinelCapsLen);
     if (!NT_SUCCESS(NtStatus))
     {
         NdisStatus = NDIS_STATUS_NOT_SUPPORTED;
@@ -480,18 +480,21 @@ Return Value:
     }
 
     // Iterate and process returned capabilities
+    NT_ASSERT(SpinelCapsDataBuffer);
     while (SpinelCapsLen > 0)
     {
         ULONG SpinelCap = 0;
         spinel_ssize_t len = spinel_datatype_unpack(SpinelCapsPtr, SpinelCapsLen, SPINEL_DATATYPE_UINT_PACKED_S, &SpinelCap);
         if (len < 1) break;
         SpinelCapsLen -= (spinel_size_t)len;
+        SpinelCapsPtr += len;
 
         switch (SpinelCap)
         {
         case SPINEL_CAP_MAC_RAW:
             pFilter->DeviceCapabilities |= OTLWF_DEVICE_CAP_RADIO;
             pFilter->DeviceCapabilities |= OTLWF_DEVICE_CAP_RADIO_ACK_TIMEOUT;
+            pFilter->DeviceCapabilities |= OTLWF_DEVICE_CAP_RADIO_MAC_RETRY_AND_COLLISION_AVOIDANCE;
             pFilter->DeviceCapabilities |= OTLWF_DEVICE_CAP_RADIO_ENERGY_SCAN;
             break;
         case SPINEL_CAP_NET_THREAD_1_0:
diff --git a/examples/drivers/windows/otLwf/radio.c b/examples/drivers/windows/otLwf/radio.c
index 10b089485..d00ddbe2e 100644
--- a/examples/drivers/windows/otLwf/radio.c
+++ b/examples/drivers/windows/otLwf/radio.c
@@ -116,6 +116,7 @@ otLwfRadioGetFactoryAddress(
     )
 {
     NTSTATUS status;
+    PVOID SpinelBuffer = NULL;
     uint8_t *hwAddress = NULL;
 
     RtlZeroMemory(&pFilter->otFactoryAddress, sizeof(pFilter->otFactoryAddress));
@@ -124,7 +125,7 @@ otLwfRadioGetFactoryAddress(
     status =
         otLwfCmdGetProp(
             pFilter,
-            NULL,
+            &SpinelBuffer,
             SPINEL_PROP_HWADDR,
             SPINEL_DATATYPE_EUI64_S,
             &hwAddress
@@ -135,7 +136,9 @@ otLwfRadioGetFactoryAddress(
         return;
     }
 
+    NT_ASSERT(SpinelBuffer);
     memcpy(&pFilter->otFactoryAddress, hwAddress, sizeof(pFilter->otFactoryAddress));
+    FILTER_FREE_MEM(SpinelBuffer);
 
     LogInfo(DRIVER_DEFAULT, "Interface %!GUID! cached factory Extended Mac Address: %llX", &pFilter->InterfaceGuid, pFilter->otFactoryAddress);
 }