Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.

Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.

Information disclosure while processing information on firmware image during core initialization.

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.

Memory corruption when the captureRead QDCM command is invoked from user-space.

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Transient DOS while parsing the received TID-to-link mapping action frame.

Transient DOS while handling PS event when Program Service name length offset value is set to 255.

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.