Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification.
Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
Transient DOS while processing CAG info IE received from NW.
Transient DOS in Modem after RRC Setup message is received.
Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.
The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which happens to be at same physical address in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, Nicobar, Rennell, SA6155P, SDM660, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
Transient DOS while decoding an ASN.1 OER message containing a SEQUENCE of unknown extensions.
Transient DOS while decoding message of size that exceeds the available system memory.
Transient DOS while processing CCCH data when NW sends data with invalid length.
Transient DOS due to improper input validation in WLAN Host.
Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation.
Possible buffer overflow due to Improper validation of received CF-ACK and CF-Poll data frames in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music
Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobile
Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to denial of service in Snapdragon Auto, Snapdragon Mobile
Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Buffer over-read while parsing RPS due to lack of check of input validation on values received from user side. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
Transient DOS while processing IE fragments from server during DTLS handshake.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
Transient DOS in Data modem while handling TLB control messages from the Network.
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
Transient DOS in WLAN Firmware while parsing a BTM request.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Transient DOS while processing TID-to-link mapping IE elements.
Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Transient DOS when processing a NULL buffer while parsing WLAN vdev.
Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
Transient DOS in Data Modem during DTLS handshake.
Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.
Transient DOS in WLAN Firmware while parsing t2lm buffers.
Transient DOS in WLAN Firmware while parsing a NAN management frame.
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
Transient DOS in WLAN Firmware while parsing rsn ies.
Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.