In all Qualcomm products with Android releases from CAF using the Linux kernel in function __mdss_fb_copy_destscaler_data() variable ds_datai.scale may still point to a user-provided address (which could point to arbitrary kernel address) so on an error condition this user-provided address will be freed (arbitrary free) and continued operation could result in use after free condition.