Qualcomm ≫ Snapdragon X75 5g Modem-rf System Firmware

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.

Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.

Memory corruption in Audio when memory map command is executed consecutively in ADSP.

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

Transient DOS in WLAN Firmware while processing a FTMR frame.

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.

Memory corruption in WLAN Host while processing RRM beacon on the AP.