Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space.
Transient DOS in WLAN Firmware while processing a FTMR frame.
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
Information disclosure in Modem while processing SIB5.
Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
Transient DOS in WLAN Firmware while parsing t2lm buffers.
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
Memory corruption in core services when Diag handler receives a command to configure event listeners.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.