Cortex-A7 module data validation checks only the first address of a caller-supplied range

Module object deallocation can free a live ThreadX kernel object

Module object allocation size overflow corrupts the manager object pool

Module Manager object lookup validates one byte of a module's search name

Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion

Deleting a user-mode module thread leaks its privileged kernel stack

Module block-pool create validates two of the four parameter words it reads

Module queue front-send validates a word count as a byte count