Broadcom suffers from a heap overflow in wlc_tdls_cal_mic_ch due to large RSN IE in TDLS Setup Confirm frame.
f077351b1ddfc2e3d37df525b0690db293b07c0b1cfd938f5a731838582762b5
Broadcom suffers from a heap overflow in the TDLS teardown while handling Fast Transition IE.
fca5109ff2bdaed221e35a197b01116c33dba171223f22d6253c126f2e2a6dbc