diff --git a/automotive/evs/1.0/vts/functional/FrameHandler.cpp b/automotive/evs/1.0/vts/functional/FrameHandler.cpp
index 6a01a44..4233430 100644
--- a/automotive/evs/1.0/vts/functional/FrameHandler.cpp
+++ b/automotive/evs/1.0/vts/functional/FrameHandler.cpp
@@ -133,6 +133,9 @@
     // Local flag we use to keep track of when the stream is stopping
     bool timeToStop = false;
 
+    // Another local flag telling whether or not current frame is displayed.
+    bool frameDisplayed = false;
+
     if (bufferArg.memHandle.getNativeHandle() == nullptr) {
         // Signal that the last frame has been received and the stream is stopped
         timeToStop = true;
@@ -172,9 +175,7 @@
                 } else {
                     // Everything looks good!
                     // Keep track so tests or watch dogs can monitor progress
-                    mLock.lock();
-                    mFramesDisplayed++;
-                    mLock.unlock();
+                    frameDisplayed = true;
                 }
             }
         }
@@ -197,12 +198,15 @@
     }
 
 
-    // Update our received frame count and notify anybody who cares that things have changed
+    // Update frame counters and notify anybody who cares that things have changed.
     mLock.lock();
     if (timeToStop) {
         mRunning = false;
     } else {
         mFramesReceived++;
+        if (frameDisplayed) {
+            mFramesDisplayed++;
+        }
     }
     mLock.unlock();
     mSignal.notify_all();
diff --git a/power/aidl/vts/VtsHalPowerTargetTest.cpp b/power/aidl/vts/VtsHalPowerTargetTest.cpp
index d14e7b6..c2216f8 100644
--- a/power/aidl/vts/VtsHalPowerTargetTest.cpp
+++ b/power/aidl/vts/VtsHalPowerTargetTest.cpp
@@ -255,11 +255,10 @@
     }
     ASSERT_TRUE(status.isOk());
 
-    if (mApiLevel < kCompatibilityMatrix8ApiLevel) {
+    status = session->setThreads(kEmptyTids);
+    if (mApiLevel < kCompatibilityMatrix8ApiLevel && isUnknownOrUnsupported(status)) {
         GTEST_SKIP() << "DEVICE not launching with Android 14 and beyond.";
     }
-
-    status = session->setThreads(kEmptyTids);
     ASSERT_FALSE(status.isOk());
     ASSERT_EQ(EX_ILLEGAL_ARGUMENT, status.getExceptionCode());
 
diff --git a/tv/cec/1.0/default/HdmiCec.cpp b/tv/cec/1.0/default/HdmiCec.cpp
index 74de785..f05f610 100644
--- a/tv/cec/1.0/default/HdmiCec.cpp
+++ b/tv/cec/1.0/default/HdmiCec.cpp
@@ -307,6 +307,9 @@
 }
 
 Return<SendMessageResult> HdmiCec::sendMessage(const CecMessage& message) {
+    if (message.body.size() > CEC_MESSAGE_BODY_MAX_LENGTH) {
+        return SendMessageResult::FAIL;
+    }
     cec_message_t legacyMessage {
         .initiator = static_cast<cec_logical_address_t>(message.initiator),
         .destination = static_cast<cec_logical_address_t>(message.destination),
diff --git a/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.cpp b/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.cpp
index 6433305..8d3395b 100644
--- a/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.cpp
+++ b/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.cpp
@@ -134,6 +134,19 @@
     return result;
 }
 
+bool TvInputAidlTest::isValidHandle(NativeHandle& handle) {
+    if (handle.fds.empty()) {
+        return false;
+    }
+    for (size_t i = 0; i < handle.fds.size(); i++) {
+        int fd = handle.fds[i].get();
+        if (fcntl(fd, F_GETFL) < 0) {
+            return false;
+        }
+    }
+    return true;
+}
+
 /*
  * GetStreamConfigTest:
  * Calls updateStreamConfigurations() for each existing device
@@ -168,6 +181,8 @@
             ALOGD("OpenAndCloseStreamTest: open stream, device_id=%d, stream_id=%d", device_id,
                   stream_id);
             ASSERT_TRUE(tv_input_->openStream(device_id, stream_id, &handle).isOk());
+            ASSERT_TRUE(isValidHandle(handle));
+
             ALOGD("OpenAndCloseStreamTest: close stream, device_id=%d, stream_id=%d", device_id,
                   stream_id);
             ASSERT_TRUE(tv_input_->closeStream(device_id, stream_id).isOk());
@@ -268,6 +283,7 @@
 
     ALOGD("OpenAnOpenedStreamsTest: open stream, device_id=%d, stream_id=%d", device_id, stream_id);
     ASSERT_TRUE(tv_input_->openStream(device_id, stream_id, &handle).isOk());
+    ASSERT_TRUE(isValidHandle(handle));
 
     ALOGD("OpenAnOpenedStreamsTest: open stream, device_id=%d, stream_id=%d", device_id, stream_id);
     ASSERT_TRUE(tv_input_->openStream(device_id, stream_id, &handle).getServiceSpecificError() ==
diff --git a/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.h b/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.h
index 832b27c..7e66a88 100644
--- a/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.h
+++ b/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.h
@@ -17,6 +17,7 @@
 #pragma once
 
 #include <android/binder_manager.h>
+#include <fcntl.h>
 
 #include <aidl/Gtest.h>
 #include <aidl/Vintf.h>
@@ -84,6 +85,9 @@
      */
     int32_t getNumNotIn(vector<int32_t>& nums);
 
+    /* Checks if a native handle contains valid file descriptor(s). */
+    bool isValidHandle(NativeHandle& handle);
+
   protected:
     shared_ptr<ITvInput> tv_input_;
     shared_ptr<TvInputCallback> tv_input_callback_;
diff --git a/tv/tuner/1.1/vts/functional/FrontendTests.cpp b/tv/tuner/1.1/vts/functional/FrontendTests.cpp
index 9f0f30d..0a645fc 100644
--- a/tv/tuner/1.1/vts/functional/FrontendTests.cpp
+++ b/tv/tuner/1.1/vts/functional/FrontendTests.cpp
@@ -379,7 +379,7 @@
                 break;
             }
             case FrontendStatusTypeExt1_1::UEC: {
-                ASSERT_TRUE(realStatuses[i].uec() == expectStatuses[i].uec());
+                ASSERT_TRUE(realStatuses[i].uec() >= 0 );
                 break;
             }
             case FrontendStatusTypeExt1_1::T2_SYSTEM_ID: {
diff --git a/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TestConfigurations.h b/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TestConfigurations.h
index 669fa11..dcdc673 100644
--- a/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TestConfigurations.h
+++ b/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TestConfigurations.h
@@ -86,7 +86,7 @@
     types.push_back(FrontendStatusTypeExt1_1::IS_MISO);
     vector<FrontendStatusExt1_1> statuses;
     FrontendStatusExt1_1 status;
-    status.uec(4);
+    status.uec(0);
     statuses.push_back(status);
     status.isMiso(true);
     statuses.push_back(status);
diff --git a/wifi/1.6/vts/functional/Android.bp b/wifi/1.6/vts/functional/Android.bp
index 2d126c7..92e6d13 100644
--- a/wifi/1.6/vts/functional/Android.bp
+++ b/wifi/1.6/vts/functional/Android.bp
@@ -23,6 +23,28 @@
     default_applicable_licenses: ["hardware_interfaces_license"],
 }
 
+cc_library_static {
+    name: "VtsHalWifiV1_6TargetTestUtil",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: [
+        "wifi_hidl_test_utils_1_6.cpp",
+    ],
+    export_include_dirs: [
+        ".",
+    ],
+    shared_libs: [
+        "libnativehelper",
+    ],
+    static_libs: [
+        "VtsHalWifiV1_0TargetTestUtil",
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.3",
+        "android.hardware.wifi@1.5",
+        "android.hardware.wifi@1.6",
+        "libwifi-system-iface",
+    ],
+}
+
 cc_test {
     name: "VtsHalWifiV1_6TargetTest",
     defaults: ["VtsHalTargetTestDefaults"],
diff --git a/wifi/1.6/vts/functional/wifi_hidl_test_utils_1_6.cpp b/wifi/1.6/vts/functional/wifi_hidl_test_utils_1_6.cpp
new file mode 100644
index 0000000..5b8115b
--- /dev/null
+++ b/wifi/1.6/vts/functional/wifi_hidl_test_utils_1_6.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <VtsHalHidlTargetCallbackBase.h>
+
+#undef NAN  // NAN is defined in bionic/libc/include/math.h:38
+
+#include <android/hardware/wifi/1.5/IWifiApIface.h>
+#include <android/hardware/wifi/1.6/IWifiChip.h>
+#include <gtest/gtest.h>
+#include <hidl/GtestPrinter.h>
+#include <hidl/ServiceManagement.h>
+
+#include "wifi_hidl_call_util.h"
+#include "wifi_hidl_test_utils.h"
+
+using ::android::sp;
+using ::android::hardware::wifi::V1_0::ChipModeId;
+using ::android::hardware::wifi::V1_0::WifiStatusCode;
+using ::android::hardware::wifi::V1_5::IWifiApIface;
+using ::android::hardware::wifi::V1_6::IfaceConcurrencyType;
+using ::android::hardware::wifi::V1_6::IWifiChip;
+
+namespace {
+
+bool findAnyModeSupportingConcurrencyType(IfaceConcurrencyType desired_type,
+                                          const std::vector<IWifiChip::ChipMode>& modes,
+                                          ChipModeId* mode_id) {
+    for (const auto& mode : modes) {
+        for (const auto& combination : mode.availableCombinations) {
+            for (const auto& iface_limit : combination.limits) {
+                const auto& iface_types = iface_limit.types;
+                if (std::find(iface_types.begin(), iface_types.end(), desired_type) !=
+                    iface_types.end()) {
+                    *mode_id = mode.id;
+                    return true;
+                }
+            }
+        }
+    }
+    return false;
+}
+
+bool configureChipToSupportConcurrencyType(const sp<IWifiChip>& wifi_chip,
+                                           IfaceConcurrencyType type,
+                                           ChipModeId* configured_mode_id) {
+    const auto& status_and_modes = HIDL_INVOKE(wifi_chip, getAvailableModes_1_6);
+    if (status_and_modes.first.code != WifiStatusCode::SUCCESS) {
+        return false;
+    }
+    if (!findAnyModeSupportingConcurrencyType(type, status_and_modes.second, configured_mode_id)) {
+        return false;
+    }
+    if (HIDL_INVOKE(wifi_chip, configureChip, *configured_mode_id).code !=
+        WifiStatusCode::SUCCESS) {
+        return false;
+    }
+    return true;
+}
+
+sp<IWifiChip> getWifiChip_1_6(const std::string& instance_name) {
+    return IWifiChip::castFrom(getWifiChip(instance_name));
+}
+
+}  // namespace
+
+sp<IWifiApIface> getBridgedWifiApIface_1_6(const std::string& instance_name) {
+    ChipModeId mode_id;
+    sp<IWifiChip> wifi_chip = getWifiChip_1_6(instance_name);
+    if (!wifi_chip.get()) return nullptr;
+    configureChipToSupportConcurrencyType(wifi_chip, IfaceConcurrencyType::AP_BRIDGED, &mode_id);
+    const auto& status_and_iface = HIDL_INVOKE(wifi_chip, createBridgedApIface);
+    return IWifiApIface::castFrom(status_and_iface.second);
+}
diff --git a/wifi/1.6/vts/functional/wifi_hidl_test_utils_1_6.h b/wifi/1.6/vts/functional/wifi_hidl_test_utils_1_6.h
new file mode 100644
index 0000000..ab8ff3b
--- /dev/null
+++ b/wifi/1.6/vts/functional/wifi_hidl_test_utils_1_6.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android/hardware/wifi/1.5/IWifiApIface.h>
+#include <android/hardware/wifi/1.6/IWifiChip.h>
+
+#include <VtsHalHidlTargetTestEnvBase.h>
+
+android::sp<android::hardware::wifi::V1_5::IWifiApIface> getBridgedWifiApIface_1_6(
+        const std::string& instance_name);
diff --git a/wifi/aidl/default/tests/README.md b/wifi/aidl/default/tests/README.md
new file mode 100644
index 0000000..fc0a98a
--- /dev/null
+++ b/wifi/aidl/default/tests/README.md
@@ -0,0 +1,14 @@
+# Vendor HAL gTest Suite
+
+## Overview
+Rather than testing an active instance of the service like the VTS tests,
+this test suite will test individual files from the Vendor HAL.
+This is especially useful for testing conversion methods (see `aidl_struct_util_unit_tests.cpp`),
+but can also be used to test things like `wifi_chip`.
+
+## Usage
+Run the test script with a device connected:
+
+```
+./runtests.sh
+```
diff --git a/wifi/aidl/default/tests/runtests.sh b/wifi/aidl/default/tests/runtests.sh
index 1f53ab8..228c82b 100755
--- a/wifi/aidl/default/tests/runtests.sh
+++ b/wifi/aidl/default/tests/runtests.sh
@@ -20,7 +20,8 @@
 fi
 set -e
 
-$ANDROID_BUILD_TOP/build/soong/soong_ui.bash --make-mode android.hardware.wifi-service-tests
 adb root
+adb wait-for-device
+$ANDROID_BUILD_TOP/build/soong/soong_ui.bash --make-mode android.hardware.wifi-service-tests
 adb sync data
 adb shell /data/nativetest64/vendor/android.hardware.wifi-service-tests/android.hardware.wifi-service-tests
diff --git a/wifi/aidl/default/wifi_chip.cpp b/wifi/aidl/default/wifi_chip.cpp
index f9f5528..344ec94 100644
--- a/wifi/aidl/default/wifi_chip.cpp
+++ b/wifi/aidl/default/wifi_chip.cpp
@@ -975,14 +975,14 @@
     br_ifaces_ap_instances_[br_ifname] = ap_instances;
     if (!iface_util_->createBridge(br_ifname)) {
         LOG(ERROR) << "Failed createBridge - br_name=" << br_ifname.c_str();
-        invalidateAndClearBridgedAp(br_ifname);
+        deleteApIface(br_ifname);
         return {nullptr, createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE)};
     }
     for (auto const& instance : ap_instances) {
         // Bind ap instance interface to AP bridge
         if (!iface_util_->addIfaceToBridge(br_ifname, instance)) {
             LOG(ERROR) << "Failed add if to Bridge - if_name=" << instance.c_str();
-            invalidateAndClearBridgedAp(br_ifname);
+            deleteApIface(br_ifname);
             return {nullptr, createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE)};
         }
     }
@@ -1016,8 +1016,7 @@
     // nan/rtt objects over AP iface. But, there is no harm to do it
     // here and not make that assumption all over the place.
     invalidateAndRemoveDependencies(ifname);
-    // Clear the bridge interface and the iface instance.
-    invalidateAndClearBridgedAp(ifname);
+    deleteApIface(ifname);
     invalidateAndClear(ap_ifaces_, iface);
     for (const auto& callback : event_cb_handler_.getCallbacks()) {
         if (!callback->onIfaceRemoved(IfaceType::AP, ifname).isOk()) {
@@ -1960,21 +1959,28 @@
     br_ifaces_ap_instances_.clear();
 }
 
-void WifiChip::invalidateAndClearBridgedAp(const std::string& br_name) {
-    if (br_name.empty()) return;
-    // delete managed interfaces
+void WifiChip::deleteApIface(const std::string& if_name) {
+    if (if_name.empty()) return;
+    // delete bridged interfaces if any
     for (auto const& it : br_ifaces_ap_instances_) {
-        if (it.first == br_name) {
+        if (it.first == if_name) {
             for (auto const& iface : it.second) {
-                iface_util_->removeIfaceFromBridge(br_name, iface);
+                iface_util_->removeIfaceFromBridge(if_name, iface);
                 legacy_hal_.lock()->deleteVirtualInterface(iface);
             }
-            iface_util_->deleteBridge(br_name);
-            br_ifaces_ap_instances_.erase(br_name);
-            break;
+            iface_util_->deleteBridge(if_name);
+            br_ifaces_ap_instances_.erase(if_name);
+            // ifname is bridged AP, return here.
+            return;
         }
     }
-    return;
+
+    // No bridged AP case, delete AP iface
+    legacy_hal::wifi_error legacy_status = legacy_hal_.lock()->deleteVirtualInterface(if_name);
+    if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+        LOG(ERROR) << "Failed to remove interface: " << if_name << " "
+                   << legacyErrorToString(legacy_status);
+    }
 }
 
 bool WifiChip::findUsingNameFromBridgedApInstances(const std::string& name) {
diff --git a/wifi/aidl/default/wifi_chip.h b/wifi/aidl/default/wifi_chip.h
index 4ddee92..e8df5ab 100644
--- a/wifi/aidl/default/wifi_chip.h
+++ b/wifi/aidl/default/wifi_chip.h
@@ -253,7 +253,7 @@
     bool writeRingbufferFilesInternal();
     std::string getWlanIfaceNameWithType(IfaceType type, unsigned idx);
     void invalidateAndClearBridgedApAll();
-    void invalidateAndClearBridgedAp(const std::string& br_name);
+    void deleteApIface(const std::string& if_name);
     bool findUsingNameFromBridgedApInstances(const std::string& name);
     ndk::ScopedAStatus triggerSubsystemRestartInternal();
     std::pair<std::vector<WifiRadioCombination>, ndk::ScopedAStatus>
diff --git a/wifi/hostapd/aidl/vts/functional/Android.bp b/wifi/hostapd/aidl/vts/functional/Android.bp
index 1942db1..33318a4 100644
--- a/wifi/hostapd/aidl/vts/functional/Android.bp
+++ b/wifi/hostapd/aidl/vts/functional/Android.bp
@@ -23,6 +23,7 @@
         "android.hardware.wifi.hostapd-V1-ndk",
         "VtsHalWifiV1_0TargetTestUtil",
         "VtsHalWifiV1_5TargetTestUtil",
+        "VtsHalWifiV1_6TargetTestUtil",
         "VtsHalWifiHostapdV1_0TargetTestUtil",
         "android.hardware.wifi.hostapd@1.0",
         "android.hardware.wifi.hostapd@1.1",
@@ -34,6 +35,7 @@
         "android.hardware.wifi@1.3",
         "android.hardware.wifi@1.4",
         "android.hardware.wifi@1.5",
+        "android.hardware.wifi@1.6",
         "android.hardware.wifi-V1-ndk",
         "libwifi-system-iface",
         "VtsHalWifiTargetTestUtil",
diff --git a/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp b/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp
index 69f1b76..efd1538 100644
--- a/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp
+++ b/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp
@@ -30,6 +30,7 @@
 #include <hostapd_hidl_test_utils.h>
 #include <wifi_hidl_test_utils.h>
 #include <wifi_hidl_test_utils_1_5.h>
+#include <wifi_hidl_test_utils_1_6.h>
 
 #include "wifi_aidl_test_utils.h"
 
@@ -143,7 +144,7 @@
     std::string setupApIfaceAndGetNameHidl(bool isBridged) {
         android::sp<::android::hardware::wifi::V1_0::IWifiApIface> wifi_ap_iface;
         if (isBridged) {
-            wifi_ap_iface = getBridgedWifiApIface_1_5(wifiHidlInstanceName);
+            wifi_ap_iface = getBridgedWifiApIface_1_6(wifiHidlInstanceName);
         } else {
             wifi_ap_iface = getWifiApIface_1_5(wifiHidlInstanceName);
         }