Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Memory corruption while station LL statistic handling.

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.

Memory corruption while handling IOCTL calls in JPEG Encoder driver.

Transient DOS while processing the CU information from RNR IE.

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Memory corruption while processing IOCTL calls to unmap the buffers.

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.