Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.
Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).
Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
Transient DOS while processing TID-to-link mapping IE elements.
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
Transient DOS while parse fils IE with length equal to 1.
Transient DOS while processing power control requests with invalid antenna or stream values.
Transient DOS while handling beacon frames with invalid IE header length.
Transient DOS while parsing the EPTM test control message to get the test pattern.
Transient DOS while handling command data during power control processing.
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
Transient DOS in Data Modem during DTLS handshake.
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
Transient DOS while parsing WLAN beacon or probe-response frame.
Transient DOS in WLAN Firmware while parsing a NAN management frame.
Transient DOS due to buffer over-read in WLAN while sending a packet to device.
Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.
Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.
Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
Transient DOS in Modem after RRC Setup message is received.
Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.
u'Reachable assertion when wrong data size is returned by parser for ape clips' in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8098, Kamorta, MSM8917, MSM8953, Nicobar, QCM2150, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Denial of service in WLAN module due to improper check of subtypes in logic where excessive frames are dropped in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
RRC sends a connection establishment success to NAS even though connection setup validation returns failure and leads to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
Transient DOS in Data modem while handling TLB control messages from the Network.
Denial of service in video due to buffer over read while parsing MP4 clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
Denial of service in MODEM due to reachable assertion while processing configuration from network in Snapdragon Mobile
Denial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in Snapdragon Mobile
Transient Denial-of-Service in WLAN due to buffer over-read while parsing MDNS frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.
Transient DOS while processing CAG info IE received from NW.
Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
Transient DOS in Modem when a Beam switch request is made with a non-configured BWP.
Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.
Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.
Transient DOS while processing IE fragments from server during DTLS handshake.
Transient DOS in Multi-Mode Call Processor while processing UE policy container.
Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.