In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel while processing the WLAN driver command ioctl a temporary buffer used to construct the reply message may be freed twice.