Memory Corruption when processing IOCTLs for JPEG data without verification

Memory corruption while accessing a buffer during IOCTL processing

Memory corruption while invoking remote procedure IOCTL calls

memory corruption while processing an image encoding completion event

Memory corruption while encoding the image data

Memory corruption due to double free when multiple threads race to set the timestamp store

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host

Memory corruption while processing an IOCTL command with an arbitrary address

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed

Memory corruption while IOCTL call is invoked from user-space to read board data

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call

Memory corruption while processing escape code in API

Memory corruption while taking snapshot when an offset variable is set by camera driver

Information disclosure while creating MQ channels

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP

Memory corruption while processing simultaneous requests via escape path

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling…

Information disclosure when Video engine escape input data is less than expected minimum size

Transient DOS while processing IOCTL call for image encoding