Qualcomm ≫ Wcd9375 Firmware

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Memory corruption while processing IOCTL calls to unmap the buffers.

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Transient DOS while processing the CU information from RNR IE.

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.

Memory corruption while maintaining memory maps of HLOS memory.

Transient DOS while parsing probe response and assoc response frame.