Memory corruption may occur during IO configuration processing when the IO port count is invalid.
Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.
Information disclosure while processing information on firmware image during core initialization.
Memory corruption while parsing the memory map info in IOCTL calls.