diff --git a/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMM.c b/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMM.c
index 5968a69292e4df5cb2b39ecd7784e5986fb5d89f..6634863f090d864ba68e23159b3bfd43cfb0aab0 100644
--- a/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMM.c
+++ b/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMM.c
@@ -77,10 +77,7 @@ void RFCOMM_ProcessPacket(void* Data, Bluetooth_Channel_t* const Channel)
 {
 	const RFCOMM_Header_t* FrameHeader  = (const RFCOMM_Header_t*)Data;
 	const uint8_t*         FrameData    = (const uint8_t*)Data + sizeof(RFCOMM_Header_t);
-	uint16_t               FrameDataLen = RFCOMM_GetFrameDataLength(FrameData);
-
-	/* Adjust the frame data pointer to skip over the variable size field */
-	FrameData += (FrameDataLen < 128) ? 1 : 2;
+	uint16_t               FrameDataLen = RFCOMM_GetVariableFieldValue(&FrameData);
 	
 	/* Decode the RFCOMM frame type from the header */
 	switch (FrameHeader->Control & ~FRAME_POLL_FINAL)
@@ -108,25 +105,40 @@ void RFCOMM_ProcessPacket(void* Data, Bluetooth_Channel_t* const Channel)
 
 RFCOMM_Channel_t* RFCOMM_GetChannelData(const uint8_t DLCI)
 {
+	/* Search through the RFCOMM channel list, looking for the specified channel */
 	for (uint8_t i = 0; i < RFCOMM_MAX_OPEN_CHANNELS; i++)
 	{
 		RFCOMM_Channel_t* CurrRFCOMMChannel = &RFCOMM_Channels[i];
 	
-		if (CurrRFCOMMChannel->DLCI == DLCI)
+		/* If the current non-closed channel's DLCI matches the search DLCI, return it to the caller */
+		if ((CurrRFCOMMChannel->DLCI == DLCI) && (CurrRFCOMMChannel->State != RFCOMM_Channel_Closed))
 		  return CurrRFCOMMChannel;
 	}
-	
+
+	/* Channel not found in the channel state table, return failure */
 	return NULL;
 }
 
-uint16_t RFCOMM_GetFrameDataLength(const uint8_t* const BufferPos)
+uint16_t RFCOMM_GetVariableFieldValue(const uint8_t** BufferPos)
 {
-	uint8_t FirstOctet  = BufferPos[0];
+	uint8_t FirstOctet;
 	uint8_t SecondOctet = 0;
 	
-	if (!(FirstOctet & 0x01))
-	  SecondOctet = BufferPos[1];
+	FirstOctet = **BufferPos;
+	(*BufferPos)++;
 	
+	/* If the field size is more than a single byte, fetch the next byte in the variable length field */
+	if (!(FirstOctet & 0x01))
+	{
+		SecondOctet = **BufferPos;
+		(*BufferPos)++;
+
+		/* Discard any remaining bytes in the variable length field that won't fit in the return value */
+		while (!(**BufferPos & 0x01))
+		  (*BufferPos)++;
+	}
+
+	/* Bitshift the bytes that comprise the variable length field so that they form a single integer */
 	return (((uint16_t)SecondOctet << 7) | FirstOctet >> 1);
 }
 
@@ -220,11 +232,13 @@ static void RFCOMM_ProcessSABM(const RFCOMM_Address_t* const FrameAddress, Bluet
 		/* If the channel's DLCI is zero, the channel state entry is free */
 		if (!(CurrRFCOMMChannel->DLCI))
 		{
-			CurrRFCOMMChannel->DLCI        = FrameAddress->DLCI;
-			CurrRFCOMMChannel->State       = RFCOMM_Channel_Open;
-			CurrRFCOMMChannel->Priority    = 7 + (CurrRFCOMMChannel->DLCI >> 3) + ((CurrRFCOMMChannel->DLCI >> 3) * 7);
-			CurrRFCOMMChannel->UseUIFrames = false;
-			CurrRFCOMMChannel->RemoteMTU   = 0xFFFF;
+			CurrRFCOMMChannel->DLCI         = FrameAddress->DLCI;
+			CurrRFCOMMChannel->State        = RFCOMM_Channel_Open;
+			CurrRFCOMMChannel->Priority     = 7 + (CurrRFCOMMChannel->DLCI >> 3) + ((CurrRFCOMMChannel->DLCI >> 3) * 7);
+			CurrRFCOMMChannel->UseUIFrames  = false;
+			CurrRFCOMMChannel->MTU          = 0xFFFF;
+			CurrRFCOMMChannel->Signals      = 0;
+			CurrRFCOMMChannel->BreakSignals = 0;
 		
 			BT_RFCOMM_DEBUG(1, ">> UA Sent");
 			RFCOMM_SendFrame(FrameAddress->DLCI, true, (RFCOMM_Frame_UA | FRAME_POLL_FINAL), 0, NULL, Channel);
diff --git a/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMM.h b/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMM.h
index 5ccfc2d237299ba850526cba7d32aef8057ef85d..78e9b54e2bdc94a3ecc4f8ee10615332bd9f0dfa 100644
--- a/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMM.h
+++ b/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMM.h
@@ -86,7 +86,10 @@
 			uint8_t  State;
 			uint8_t  Priority;
 			bool     UseUIFrames;
-			uint16_t RemoteMTU;
+			uint16_t MTU;
+			uint8_t  StatusFlags;
+			uint8_t  Signals;
+			uint8_t  BreakSignals;
 		} RFCOMM_Channel_t;
 		
 	/* External Variables: */
@@ -97,7 +100,7 @@
 		void              RFCOMM_ProcessPacket(void* Data, Bluetooth_Channel_t* const Channel);
 		
 		RFCOMM_Channel_t* RFCOMM_GetChannelData(const uint8_t DLCI);
-		uint16_t          RFCOMM_GetFrameDataLength(const uint8_t* const BufferPos);
+		uint16_t          RFCOMM_GetVariableFieldValue(const uint8_t** BufferPos);
 		void              RFCOMM_SendFrame(const uint8_t DLCI, const bool CommandResponse, const uint8_t Control,
 			                               const uint16_t DataLen, const void* Data, Bluetooth_Channel_t* const Channel);
 
diff --git a/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMMControl.c b/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMMControl.c
index 23a18765fb3d6aaf65286f6e7fca0e58b1c19a1c..3a6bf67c50cf0ec899778d281684945f3b31ec24 100644
--- a/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMMControl.c
+++ b/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMMControl.c
@@ -42,10 +42,7 @@ void RFCOMM_ProcessControlCommand(const uint8_t* Command, Bluetooth_Channel_t* c
 {
 	const RFCOMM_Command_t* CommandHeader  = (const RFCOMM_Command_t*)Command;
 	const uint8_t*          CommandData    = (const uint8_t*)Command + sizeof(RFCOMM_Command_t);
-	uint16_t                ControlDataLen = RFCOMM_GetFrameDataLength(CommandData);
-
-	/* Adjust the command data pointer to skip over the variable size field */
-	CommandData += (ControlDataLen < 128) ? 1 : 2;
+	uint8_t                 CommandDataLen = RFCOMM_GetVariableFieldValue(&CommandData);
 
 	switch (CommandHeader->Command)
 	{
@@ -59,7 +56,7 @@ void RFCOMM_ProcessControlCommand(const uint8_t* Command, Bluetooth_Channel_t* c
 			RFCOMM_ProcessFCDCommand(CommandHeader, CommandData, Channel);
 			break;
 		case RFCOMM_Control_ModemStatus:
-			RFCOMM_ProcessMSCommand(CommandHeader, CommandData, Channel);
+			RFCOMM_ProcessMSCommand(CommandHeader, CommandDataLen, CommandData, Channel);
 			break;
 		case RFCOMM_Control_RemotePortNegotiation:
 			RFCOMM_ProcessRPNCommand(CommandHeader, CommandData, Channel);
@@ -94,10 +91,48 @@ static void RFCOMM_ProcessFCDCommand(const RFCOMM_Command_t* const CommandHeader
 	BT_RFCOMM_DEBUG(1, "<< FCD Command");
 }
 
-static void RFCOMM_ProcessMSCommand(const RFCOMM_Command_t* const CommandHeader, const uint8_t* CommandData,
-			                        Bluetooth_Channel_t* const Channel)
+static void RFCOMM_ProcessMSCommand(const RFCOMM_Command_t* const CommandHeader, const uint8_t CommandDataLen,
+                                    const uint8_t* CommandData, Bluetooth_Channel_t* const Channel)
 {
+	const RFCOMM_MS_Parameters_t* Params = (const RFCOMM_MS_Parameters_t*)CommandData;
+
 	BT_RFCOMM_DEBUG(1, "<< MS Command");
+	BT_RFCOMM_DEBUG(2, "-- DLCI: 0x%02X", Params->Channel.DLCI);
+	
+	/* Ignore status flags sent to the control channel */
+	if (Params->Channel.DLCI == RFCOMM_CONTROL_DLCI)
+	  return;
+	
+	/* Retrieve existing channel configuration data, if already opened */
+	RFCOMM_Channel_t* RFCOMMChannel = RFCOMM_GetChannelData(Params->Channel.DLCI);	
+	
+	/* If the channel does not exist, abort */
+	if (RFCOMMChannel == NULL)
+	  return;
+	  
+	/* Save the new channel signals to the channel state structure */
+	RFCOMMChannel->Signals = Params->Signals;
+	
+	/* If the command contains the optional break signals field, store the value */
+	if (CommandDataLen == sizeof(RFCOMM_MS_Parameters_t))
+	  RFCOMMChannel->BreakSignals = Params->BreakSignals;
+	  
+	struct
+	{
+		RFCOMM_Command_t       CommandHeader;
+		uint8_t                Length;
+		RFCOMM_MS_Parameters_t Params;
+	} MSResponse;
+
+	/* Fill out the MS response data */
+	MSResponse.CommandHeader = (RFCOMM_Command_t){.Command = RFCOMM_Control_ModemStatus, .EA = true};
+	MSResponse.Length        = (CommandDataLen << 1) | 0x01;
+	MSResponse.Params        = *Params;
+	
+	BT_RFCOMM_DEBUG(1, ">> MS Response");
+
+	/* Send the PDN response to acknowledge the command */
+	RFCOMM_SendFrame(RFCOMM_CONTROL_DLCI, false, RFCOMM_Frame_UIH, sizeof(MSResponse), &MSResponse, Channel);
 }
 
 static void RFCOMM_ProcessRPNCommand(const RFCOMM_Command_t* const CommandHeader, const uint8_t* CommandData,
@@ -118,7 +153,7 @@ static void RFCOMM_ProcessDPNCommand(const RFCOMM_Command_t* const CommandHeader
 	const RFCOMM_DPN_Parameters_t* Params = (const RFCOMM_DPN_Parameters_t*)CommandData;
 
 	BT_RFCOMM_DEBUG(1, "<< DPN Command");
-	BT_RFCOMM_DEBUG(2, "-- Config DLCI: 0x%02X", Params->DLCI);
+	BT_RFCOMM_DEBUG(2, "-- DLCI: 0x%02X", Params->DLCI);
 	
 	/* Ignore parameter negotiations to the control channel */
 	if (Params->DLCI == RFCOMM_CONTROL_DLCI)
@@ -136,8 +171,10 @@ static void RFCOMM_ProcessDPNCommand(const RFCOMM_Command_t* const CommandHeader
 			/* If the channel's DLCI is zero, the channel state entry is free */
 			if (!(RFCOMM_Channels[i].DLCI))
 			{
-				RFCOMMChannel       = &RFCOMM_Channels[i];
-				RFCOMMChannel->DLCI = Params->DLCI;
+				RFCOMMChannel               = &RFCOMM_Channels[i];
+				RFCOMMChannel->DLCI         = Params->DLCI;
+				RFCOMMChannel->Signals      = 0;
+				RFCOMMChannel->BreakSignals = 0;
 				break;
 			}
 		}
@@ -154,7 +191,7 @@ static void RFCOMM_ProcessDPNCommand(const RFCOMM_Command_t* const CommandHeader
 	RFCOMMChannel->State       = RFCOMM_Channel_Open;
 	RFCOMMChannel->Priority    = Params->Priority;
 	RFCOMMChannel->UseUIFrames = (Params->FrameType != 0);
-	RFCOMMChannel->RemoteMTU   = Params->MaximumFrameSize;
+	RFCOMMChannel->MTU         = Params->MaximumFrameSize;
 	
 	struct
 	{
@@ -164,10 +201,10 @@ static void RFCOMM_ProcessDPNCommand(const RFCOMM_Command_t* const CommandHeader
 	} DPNResponse;
 	
 	/* Fill out the DPN response data */
-	DPNResponse.CommandHeader.Command = CommandHeader->Command;
-	DPNResponse.CommandHeader.EA      = true;
-	DPNResponse.Length                = (sizeof(DPNResponse.Params) << 1) | 0x01;
-	DPNResponse.Params                = *Params;
+	DPNResponse.CommandHeader           = (RFCOMM_Command_t){.Command = RFCOMM_Control_DLCParameterNegotiation, .EA = true};
+	DPNResponse.Length                  = (sizeof(DPNResponse.Params) << 1) | 0x01;
+	DPNResponse.Params                  = *Params;
+	DPNResponse.Params.ConvergenceLayer = 0x00; // TODO: Enable credit based transaction support
 	
 	BT_RFCOMM_DEBUG(1, ">> DPN Response");
 
diff --git a/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMMControl.h b/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMMControl.h
index e12c74c763a5e8ba6e55f9d9b84b4cc44e7a5c79..8cefa51c70bea614a30d0b4a136bd9b1d257e1d2 100644
--- a/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMMControl.h
+++ b/Demos/Host/Incomplete/BluetoothHost/Lib/RFCOMMControl.h
@@ -50,7 +50,11 @@
 		#include "RFCOMM.h"
 		
 	/* Macros: */
-		#define RFCOMM_
+		#define RFCOMM_STATUSFLAG_FC     (1 << 1)
+		#define RFCOMM_STATUSFLAG_RTC    (1 << 2)
+		#define RFCOMM_STATUSFLAG_RTR    (1 << 3)
+		#define RFCOMM_STATUSFLAG_IC     (1 << 6)
+		#define RFCOMM_STATUSFLAG_DV     (1 << 7)
 
 	/* Enums: */
 		enum RFCOMM_Control_Commands_t
@@ -97,6 +101,13 @@
 			uint8_t          MaxRetransmissions;
 			uint8_t          RecoveryWindowSize;			
 		} RFCOMM_DPN_Parameters_t;
+		
+		typedef struct
+		{
+			RFCOMM_Address_t Channel;
+			uint8_t          Signals;
+			uint8_t          BreakSignals;
+		} RFCOMM_MS_Parameters_t;
 
 	/* Function Prototypes: */
 		void RFCOMM_ProcessControlCommand(const uint8_t* Command, Bluetooth_Channel_t* const Channel);
@@ -108,8 +119,8 @@
 			                                     Bluetooth_Channel_t* const Channel);
 			static void RFCOMM_ProcessFCDCommand(const RFCOMM_Command_t* const CommandHeader, const uint8_t* CommandData,
 			                                     Bluetooth_Channel_t* const Channel);
-			static void RFCOMM_ProcessMSCommand(const RFCOMM_Command_t* const CommandHeader, const uint8_t* CommandData,
-			                                    Bluetooth_Channel_t* const Channel);
+			static void RFCOMM_ProcessMSCommand(const RFCOMM_Command_t* const CommandHeader, const uint8_t CommandDataLen,
+			                                    const uint8_t* CommandData, Bluetooth_Channel_t* const Channel);
 			static void RFCOMM_ProcessRPNCommand(const RFCOMM_Command_t* const CommandHeader, const uint8_t* CommandData,
 			                                     Bluetooth_Channel_t* const Channel);
 			static void RFCOMM_ProcessRLSCommand(const RFCOMM_Command_t* const CommandHeader, const uint8_t* CommandData,