Qualcomm ≫ Sa8540p Firmware

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

Cryptographic issue while parsing RSA keys in COBR format.

Memory corruption while releasing shared resources in MinkSocket listener thread.

memory corruption when an invalid firehose patch command is invoked.

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.

Memory corruption while processing IOCTL call to set metainfo.

Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.