diff --git a/libfreerdp/core/capabilities.c b/libfreerdp/core/capabilities.c
index 497830188..f9299ad6d 100644
--- a/libfreerdp/core/capabilities.c
+++ b/libfreerdp/core/capabilities.c
@@ -3307,7 +3307,9 @@ static BOOL rdp_read_codec_ts_rfx_clnt_caps_container(wStream* s, rdpSettings* s
 	wStream* sub = Stream_StaticConstInit(&sbuffer, Stream_Pointer(s), rfxPropsLength - 4ull);
 	WINPR_ASSERT(sub);
 
-	if (!Stream_CheckAndLogRequiredLength(TAG, s, 8))
+	Stream_Seek(s, rfxPropsLength - 4ull);
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, sub, 8))
 		return FALSE;
 
 	Stream_Read_UINT32(sub, captureFlags);  /* captureFlags (4 bytes) */
diff --git a/server/proxy/channels/pf_channel_drdynvc.c b/server/proxy/channels/pf_channel_drdynvc.c
index 9d8cab905..112d39941 100644
--- a/server/proxy/channels/pf_channel_drdynvc.c
+++ b/server/proxy/channels/pf_channel_drdynvc.c
@@ -311,9 +311,9 @@ static PfChannelResult DynvcTrackerPeekFn(ChannelStateTracker* tracker, BOOL fir
 		 */
 		dynChannel = (pServerDynamicChannelContext*)HashTable_GetItemValue(
 		    dynChannelContext->channels, &dynChannelId);
-		if (cmd != CREATE_REQUEST_PDU || !isBackData)
+		if ((cmd != CREATE_REQUEST_PDU) || !isBackData)
 		{
-			if (!dynChannel)
+			if (!dynChannel || (dynChannel->openStatus == CHANNEL_OPENSTATE_CLOSED))
 			{
 				/* we've not found the target channel, so we drop this chunk, plus all the rest of
 				 * the packet */
diff --git a/server/proxy/pf_channel.c b/server/proxy/pf_channel.c
index a8f66c4e7..1d771beeb 100644
--- a/server/proxy/pf_channel.c
+++ b/server/proxy/pf_channel.c
@@ -291,6 +291,7 @@ static PfChannelResult pf_channel_generic_front_data(proxyData* pdata,
 
 BOOL pf_channel_setup_generic(pServerStaticChannelContext* channel)
 {
+	WINPR_ASSERT(channel);
 	channel->onBackData = pf_channel_generic_back_data;
 	channel->onFrontData = pf_channel_generic_front_data;
 	return TRUE;
diff --git a/server/proxy/pf_context.c b/server/proxy/pf_context.c
index 04433d9dc..8c6b107c4 100644
--- a/server/proxy/pf_context.c
+++ b/server/proxy/pf_context.c
@@ -26,6 +26,7 @@
 
 #include <freerdp/server/proxy/proxy_log.h>
 #include <freerdp/server/proxy/proxy_server.h>
+#include <freerdp/channels/drdynvc.h>
 
 #include "pf_client.h"
 #include "pf_utils.h"
@@ -52,6 +53,31 @@ static BOOL ChannelId_Compare(const void* pv1, const void* pv2)
 	return (*v1 == *v2);
 }
 
+static BOOL dyn_intercept(pServerContext* ps, const char* name)
+{
+	if (strncmp(DRDYNVC_SVC_CHANNEL_NAME, name, sizeof(DRDYNVC_SVC_CHANNEL_NAME)) != 0)
+		return FALSE;
+
+	WINPR_ASSERT(ps);
+	WINPR_ASSERT(ps->pdata);
+
+	const proxyConfig* cfg = ps->pdata->config;
+	WINPR_ASSERT(cfg);
+	if (!cfg->GFX)
+		return TRUE;
+	if (!cfg->AudioOutput)
+		return TRUE;
+	if (!cfg->AudioInput)
+		return TRUE;
+	if (!cfg->Multitouch)
+		return TRUE;
+	if (!cfg->VideoRedirection)
+		return TRUE;
+	if (!cfg->CameraRedirection)
+		return TRUE;
+	return FALSE;
+}
+
 pServerStaticChannelContext* StaticChannelContext_new(pServerContext* ps, const char* name,
                                                       UINT32 id)
 {
@@ -77,6 +103,8 @@ pServerStaticChannelContext* StaticChannelContext_new(pServerContext* ps, const
 	                          &channel) &&
 	    channel.intercept)
 		ret->channelMode = PF_UTILS_CHANNEL_INTERCEPT;
+	else if (dyn_intercept(ps, name))
+		ret->channelMode = PF_UTILS_CHANNEL_INTERCEPT;
 	else
 		ret->channelMode = pf_utils_get_channel_mode(ps->pdata->config, name);
 	return ret;
diff --git a/server/proxy/pf_server.c b/server/proxy/pf_server.c
index 5a4828b2a..1562bb123 100644
--- a/server/proxy/pf_server.c
+++ b/server/proxy/pf_server.c
@@ -213,7 +213,8 @@ static BOOL pf_server_setup_channels(freerdp_peer* peer)
 			goto fail;
 		}
 
-		if (strcmp(cname, DRDYNVC_SVC_CHANNEL_NAME) == 0)
+		if ((strcmp(cname, DRDYNVC_SVC_CHANNEL_NAME) == 0) &&
+		    (channelContext->channelMode == PF_UTILS_CHANNEL_INTERCEPT))
 		{
 			if (!pf_channel_setup_drdynvc(ps->pdata, channelContext))
 			{