In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel buffer over-read is possible in camera driver function msm_isp_stop_stats_stream. Variable stream_cfg_cmd->num_streams is from userspace and it is not checked against \MSM_ISP_STATS_MAX\.