diff --git a/sonoff/_changelog.ino b/sonoff/_changelog.ino
index 910f70bbc..c34a70697 100644
--- a/sonoff/_changelog.ino
+++ b/sonoff/_changelog.ino
@@ -1,4 +1,7 @@
-/* 6.2.1.1 20180905
+/* 6.2.1.2 20180906
+ * Fix KNX PA exception. Regression from 6.2.1 buffer overflow (#3700, #3710)
+ *
+ * 6.2.1.1 20180905
  * Rewrite energy monitoring using energy sensor driver modules
  * Add Wifi channel number to state message (#3664)
  * Add support for Shelly 1 and basic support for Shelly 2 - No energy monitoring yet (#2789)
diff --git a/sonoff/settings.h b/sonoff/settings.h
index 3876baf60..7a44ef9cc 100644
--- a/sonoff/settings.h
+++ b/sonoff/settings.h
@@ -64,7 +64,7 @@ typedef union {                            // Restricted by MISRA-C Rule 18.4 bu
   uint32_t data;                           // Allow bit manipulation using SetOption
   struct {                                 // SetOption50 .. SetOption81
     uint32_t timers_enable : 1;            // bit 0 (v6.1.1b)
-    uint32_t spare01 : 1;
+    uint32_t user_esp8285_enable : 1;      // bit 1 (v6.1.1.14)
     uint32_t spare02 : 1;
     uint32_t spare03 : 1;
     uint32_t spare04 : 1;
@@ -94,7 +94,7 @@ typedef union {                            // Restricted by MISRA-C Rule 18.4 bu
     uint32_t spare28 : 1;
     uint32_t spare29 : 1;
     uint32_t spare30 : 1;
-    uint32_t user_esp8285_enable : 1;      // bit 31 (v6.1.1.14)
+    uint32_t spare31 : 1;
   };
 } SysBitfield3;
 
diff --git a/sonoff/sonoff.ino b/sonoff/sonoff.ino
index a7315623d..b3760faa2 100755
--- a/sonoff/sonoff.ino
+++ b/sonoff/sonoff.ino
@@ -843,9 +843,11 @@ void MqttDataHandler(char* topic, byte* data, unsigned int data_len)
     else if ((CMND_GPIO == command_code) && (index < MAX_GPIO_PIN)) {
       mytmplt cmodule;
       memcpy_P(&cmodule, &kModules[Settings.module], sizeof(cmodule));
-      if ((GPIO_USER == cmodule.gp.io[index]) && (payload >= 0) && (payload < GPIO_SENSOR_END)) {
+//      if ((GPIO_USER == cmodule.gp.io[index]) && (payload >= 0) && (payload < GPIO_SENSOR_END)) {
+      if ((GPIO_USER == ValidGPIO(index, cmodule.gp.io[index])) && (payload >= 0) && (payload < GPIO_SENSOR_END)) {
         for (byte i = 0; i < MAX_GPIO_PIN; i++) {
-          if ((GPIO_USER == cmodule.gp.io[i]) && (Settings.my_gp.io[i] == payload)) {
+//          if ((GPIO_USER == cmodule.gp.io[i]) && (Settings.my_gp.io[i] == payload)) {
+          if ((GPIO_USER == ValidGPIO(i, cmodule.gp.io[i])) && (Settings.my_gp.io[i] == payload)) {
             Settings.my_gp.io[i] = 0;
           }
         }
@@ -854,7 +856,8 @@ void MqttDataHandler(char* topic, byte* data, unsigned int data_len)
       }
       snprintf_P(mqtt_data, sizeof(mqtt_data), PSTR("{"));
       for (byte i = 0; i < MAX_GPIO_PIN; i++) {
-        if (GPIO_USER == cmodule.gp.io[i]) {
+//        if (GPIO_USER == cmodule.gp.io[i]) {
+        if (GPIO_USER == ValidGPIO(i, cmodule.gp.io[i])) {
           if (jsflg) snprintf_P(mqtt_data, sizeof(mqtt_data), PSTR("%s,"), mqtt_data);
           jsflg = 1;
           snprintf_P(mqtt_data, sizeof(mqtt_data), PSTR("%s\"" D_CMND_GPIO "%d\":\"%d (%s)\""),
diff --git a/sonoff/sonoff_version.h b/sonoff/sonoff_version.h
index f4df759c8..178e0af68 100644
--- a/sonoff/sonoff_version.h
+++ b/sonoff/sonoff_version.h
@@ -20,7 +20,7 @@
 #ifndef _SONOFF_VERSION_H_
 #define _SONOFF_VERSION_H_
 
-#define VERSION            0x06020101
+#define VERSION            0x06020102
 
 #define D_PROGRAMNAME      "Sonoff-Tasmota"
 #define D_AUTHOR           "Theo Arends"