Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host

The cam_get_device_priv function does not check the type of handle being returned (device/session/link)

Buffer overflow can occur if invalid header tries to overwrite the existing buffer which fix size allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE