Qualcomm ≫ Mdm9650 Firmware

Information disclosure in Audio while accessing AVCS services from ADSP payload.

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.

Memory corruption in Audio when memory map command is executed consecutively in ADSP.

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.

Memory corruption in HLOS while running playready use-case.

Memory corruption in Audio during playback with speaker protection.

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.