Possible buffer over read due to lack of size validation while unpacking frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.

Transient DOS while parsing probe response and assoc response frame.

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.

Possible buffer over read due to improper validation of SIB type when processing a NR system Information message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Possible buffer over read due to improper calculation of string length while parsing Id3 tag in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Transient DOS while processing the CU information from RNR IE.

Transient DOS while processing TID-to-link mapping IE elements.

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.