In all Qualcomm products with Android releases from CAF using the Linux kernel user controlled variables \nr_cmds\ and \nr_bos\ number are passed across functions without any check. An integer overflow to buffer overflow (with a smaller buffer allocated) may occur when they are too large or negative.