In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel while processing the SENDACTIONFRAME IOCTL a buffer over-read can occur if the payload length is less than 7.