In Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05 whenever TDLS connection is setup we are freeing the netbuf in ol_tx_completion_handler and after that we are accessing it in NBUF_UPDATE_TX_PKT_COUNT causing a use after free.