Memory corruption during management frame processing due to mismatch in T2LM info element.
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
Memory corruption while parsing qcp clip with invalid chunk data size.
Memory corruption while processing IOCTL handler in FastRPC.
Transient DOS while parse fils IE with length equal to 1.
Memory corruption while processing multiple simultaneous escape calls.
Memory corruption when IOCTL call is invoked from user-space to read board data.
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Transient DOS during hypervisor virtual I/O operation in a virtual machine.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
Memory corruption while invoking HGSL IOCTL context create.
Memory corruption while running VK synchronization with KASAN enabled.
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.