diff --git a/include/re_bfcp.h b/include/re_bfcp.h
index 13086eb..444c7a2 100644
--- a/include/re_bfcp.h
+++ b/include/re_bfcp.h
@@ -223,7 +223,7 @@ typedef void (bfcp_resp_h)(int err, const struct bfcp_msg *msg, void *arg);
 
 
 /* attr */
-int bfcp_attrs_vencode(struct mbuf *mb, unsigned attrc, va_list ap);
+int bfcp_attrs_vencode(struct mbuf *mb, unsigned attrc, va_list *ap);
 int bfcp_attrs_encode(struct mbuf *mb, unsigned attrc, ...);
 struct bfcp_attr *bfcp_attr_subattr(const struct bfcp_attr *attr,
 				    enum bfcp_attrib type);
@@ -238,7 +238,7 @@ const char *bfcp_errcode_name(enum bfcp_err code);
 /* msg */
 int bfcp_msg_vencode(struct mbuf *mb, uint8_t ver, bool r, enum bfcp_prim prim,
 		     uint32_t confid, uint16_t tid, uint16_t userid,
-		     unsigned attrc, va_list ap);
+		     unsigned attrc, va_list *ap);
 int bfcp_msg_encode(struct mbuf *mb, uint8_t ver, bool r, enum bfcp_prim prim,
 		    uint32_t confid, uint16_t tid, uint16_t userid,
 		    unsigned attrc, ...);
diff --git a/src/bfcp/attr.c b/src/bfcp/attr.c
index 5d94161..03e62f6 100644
--- a/src/bfcp/attr.c
+++ b/src/bfcp/attr.c
@@ -148,7 +148,7 @@ static int attr_encode(struct mbuf *mb, bool mand, enum bfcp_attrib type,
  *
  * @return 0 if success, otherwise errorcode
  */
-int bfcp_attrs_vencode(struct mbuf *mb, unsigned attrc, va_list ap)
+int bfcp_attrs_vencode(struct mbuf *mb, unsigned attrc, va_list *ap)
 {
 	unsigned i;
 
@@ -157,9 +157,9 @@ int bfcp_attrs_vencode(struct mbuf *mb, unsigned attrc, va_list ap)
 
 	for (i=0; i<attrc; i++) {
 
-		int  type     = va_arg(ap, int);
-		unsigned subc = va_arg(ap, unsigned);
-		const void *v = va_arg(ap, const void *);
+		int  type     = va_arg(*ap, int);
+		unsigned subc = va_arg(*ap, unsigned);
+		const void *v = va_arg(*ap, const void *);
 		size_t start, len;
 		int err;
 
@@ -221,7 +221,7 @@ int bfcp_attrs_encode(struct mbuf *mb, unsigned attrc, ...)
 	int err;
 
 	va_start(ap, attrc);
-	err = bfcp_attrs_vencode(mb, attrc, ap);
+	err = bfcp_attrs_vencode(mb, attrc, &ap);
 	va_end(ap);
 
 	return err;
diff --git a/src/bfcp/bfcp.h b/src/bfcp/bfcp.h
index 34d3072..28fd6ad 100644
--- a/src/bfcp/bfcp.h
+++ b/src/bfcp/bfcp.h
@@ -51,4 +51,4 @@ int bfcp_send(struct bfcp_conn *bc, const struct sa *dst, struct mbuf *mb);
 bool bfcp_handle_response(struct bfcp_conn *bc, const struct bfcp_msg *msg);
 int  bfcp_vrequest(struct bfcp_conn *bc, const struct sa *dst,
 		   enum bfcp_prim prim, uint32_t confid, uint16_t userid,
-		   bfcp_resp_h *resph, void *arg, uint32_t attrc, va_list ap);
+		   bfcp_resp_h *resph, void *arg, uint32_t attrc, va_list *ap);
diff --git a/src/bfcp/msg.c b/src/bfcp/msg.c
index 15500d2..03f0b72 100644
--- a/src/bfcp/msg.c
+++ b/src/bfcp/msg.c
@@ -94,7 +94,7 @@ static int hdr_decode(struct bfcp_msg *msg, struct mbuf *mb)
  */
 int bfcp_msg_vencode(struct mbuf *mb, uint8_t ver, bool r, enum bfcp_prim prim,
 		     uint32_t confid, uint16_t tid, uint16_t userid,
-		     unsigned attrc, va_list ap)
+		     unsigned attrc, va_list *ap)
 {
 	size_t start, len;
 	int err;
@@ -143,7 +143,7 @@ int bfcp_msg_encode(struct mbuf *mb, uint8_t ver, bool r, enum bfcp_prim prim,
 
 	va_start(ap, attrc);
 	err = bfcp_msg_vencode(mb, ver, r, prim, confid, tid, userid,
-			       attrc, ap);
+			       attrc, &ap);
 	va_end(ap);
 
 	return err;
diff --git a/src/bfcp/reply.c b/src/bfcp/reply.c
index 35c1590..24917fe 100644
--- a/src/bfcp/reply.c
+++ b/src/bfcp/reply.c
@@ -56,7 +56,7 @@ int bfcp_reply(struct bfcp_conn *bc, const struct bfcp_msg *req,
 
 	va_start(ap, attrc);
 	err = bfcp_msg_vencode(bc->mb, BFCP_VER2, true, prim, req->confid,
-			       req->tid, req->userid, attrc, ap);
+			       req->tid, req->userid, attrc, &ap);
 	va_end(ap);
 
 	if (err)
diff --git a/src/bfcp/request.c b/src/bfcp/request.c
index b37bd1c..616d256 100644
--- a/src/bfcp/request.c
+++ b/src/bfcp/request.c
@@ -142,7 +142,7 @@ bool bfcp_handle_response(struct bfcp_conn *bc, const struct bfcp_msg *msg)
 
 int bfcp_vrequest(struct bfcp_conn *bc, const struct sa *dst,
 		  enum bfcp_prim prim, uint32_t confid, uint16_t userid,
-		  bfcp_resp_h *resph, void *arg, uint32_t attrc, va_list ap)
+		  bfcp_resp_h *resph, void *arg, uint32_t attrc, va_list *ap)
 {
 	struct bfcp_ctrans *ct;
 	int err;
@@ -220,7 +220,7 @@ int bfcp_request(struct bfcp_conn *bc, const struct sa *dst,
 
 	va_start(ap, attrc);
 	err = bfcp_vrequest(bc, dst, prim, confid, userid, resph, arg,
-			    attrc, ap);
+			    attrc, &ap);
 	va_end(ap);
 
 	return err;
@@ -248,7 +248,7 @@ int bfcp_notify(struct bfcp_conn *bc, const struct sa *dst,
 
 	va_start(ap, attrc);
 	err = bfcp_vrequest(bc, dst, prim, confid, userid, NULL, NULL,
-			    attrc, ap);
+			    attrc, &ap);
 	va_end(ap);
 
 	return err;