GPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore

GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)

GPU DDK - KASAN Read UAF in the PVRSRVBridgeRGXSubmitTransfer2 due to improper error handling code

Possible kernel exceptions caused by reading and writing kernel heap data after free

GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast`

GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory

GPU DDK - SharedSecMem mapped into all GPU virtual address spaces

GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused

GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address

GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it

GPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAF

GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled

GPU DDK - rgxfw_hwperf_config OOB read & write

GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()

GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs

GPU DDK - psContext->eDM gives OOB write