diff --git a/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VmsUtils.h b/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VmsUtils.h
index 7082566..87010ce 100644
--- a/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VmsUtils.h
+++ b/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VmsUtils.h
@@ -60,6 +60,8 @@
 };
 
 struct VmsLayerAndPublisher {
+    VmsLayerAndPublisher(VmsLayer layer, int publisher_id)
+        : layer(layer), publisher_id(publisher_id) {}
     VmsLayer layer;
     int publisher_id;
 };
@@ -162,12 +164,16 @@
 std::unique_ptr<VehiclePropValue> createSubscriptionsRequest();
 
 // Creates a VehiclePropValue containing a message of type VmsMessageType.DATA.
-// Returns a nullptr if the byte string in bytes is empty.
+// Returns a nullptr if the vms_packet string in bytes is empty or if the layer_publisher
+// information in VmsLayerAndPublisher format is missing the later or publisher
+// information.
 //
 // For example, to build a VehiclePropValue message containing a proto, the caller
-// should convert the proto to a byte string using the SerializeToString proto
-// API, then use this inteface to build the VehicleProperty.
-std::unique_ptr<VehiclePropValue> createDataMessage(const std::string& bytes);
+// should first convert the proto to a byte string (vms_packet) using the
+// SerializeToString proto API. Then, it use this interface to build the VehicleProperty
+// by passing publisher and layer information (layer_publisher) and the vms_packet.
+std::unique_ptr<VehiclePropValue> CreateDataMessageWithLayerPublisherInfo(
+        const VmsLayerAndPublisher& layer_publisher, const std::string& vms_packet);
 
 // Creates a VehiclePropValue containing a message of type
 // VmsMessageType.PUBLISHER_ID_REQUEST with the given publisher information.
diff --git a/automotive/vehicle/2.0/default/common/src/VmsUtils.cpp b/automotive/vehicle/2.0/default/common/src/VmsUtils.cpp
index 111f6ea..f16489c 100644
--- a/automotive/vehicle/2.0/default/common/src/VmsUtils.cpp
+++ b/automotive/vehicle/2.0/default/common/src/VmsUtils.cpp
@@ -126,10 +126,13 @@
     return result;
 }
 
-std::unique_ptr<VehiclePropValue> createDataMessage(const std::string& bytes) {
-    auto result = createBaseVmsMessage(kMessageTypeSize);
-    result->value.int32Values = hidl_vec<int32_t>{toInt(VmsMessageType::DATA)};
-    result->value.bytes = std::vector<uint8_t>(bytes.begin(), bytes.end());
+std::unique_ptr<VehiclePropValue> CreateDataMessageWithLayerPublisherInfo(
+        const VmsLayerAndPublisher& layer_publisher, const std::string& vms_packet) {
+    auto result = createBaseVmsMessage(kMessageTypeSize + kLayerAndPublisherSize);
+    result->value.int32Values = hidl_vec<int32_t>{
+            toInt(VmsMessageType::DATA), layer_publisher.layer.type, layer_publisher.layer.subtype,
+            layer_publisher.layer.version, layer_publisher.publisher_id};
+    result->value.bytes = std::vector<uint8_t>(vms_packet.begin(), vms_packet.end());
     return result;
 }
 
diff --git a/automotive/vehicle/2.0/default/tests/VmsUtils_test.cpp b/automotive/vehicle/2.0/default/tests/VmsUtils_test.cpp
index 2b3efc7..8a434c8 100644
--- a/automotive/vehicle/2.0/default/tests/VmsUtils_test.cpp
+++ b/automotive/vehicle/2.0/default/tests/VmsUtils_test.cpp
@@ -139,12 +139,23 @@
 }
 
 TEST(VmsUtilsTest, dataMessage) {
-    std::string bytes = "aaa";
-    auto message = createDataMessage(bytes);
+    const std::string bytes = "aaa";
+    const VmsLayerAndPublisher layer_and_publisher(VmsLayer(2, 0, 1), 123);
+    auto message = CreateDataMessageWithLayerPublisherInfo(layer_and_publisher, bytes);
     ASSERT_NE(message, nullptr);
     EXPECT_TRUE(isValidVmsMessage(*message));
     EXPECT_EQ(message->prop, toInt(VehicleProperty::VEHICLE_MAP_SERVICE));
-    EXPECT_EQ(message->value.int32Values.size(), 0x1ul);
+    EXPECT_EQ(message->value.int32Values.size(), 0x5ul);
+    EXPECT_EQ(message->value.int32Values[0], toInt(VmsMessageType::DATA));
+
+    // Layer
+    EXPECT_EQ(message->value.int32Values[1], 2);
+    EXPECT_EQ(message->value.int32Values[2], 0);
+    EXPECT_EQ(message->value.int32Values[3], 1);
+
+    // Publisher ID
+    EXPECT_EQ(message->value.int32Values[4], 123);
+
     EXPECT_EQ(parseMessageType(*message), VmsMessageType::DATA);
     EXPECT_EQ(message->value.bytes.size(), bytes.size());
     EXPECT_EQ(memcmp(message->value.bytes.data(), bytes.data(), bytes.size()), 0);
@@ -164,8 +175,9 @@
 }
 
 TEST(VmsUtilsTest, parseDataMessage) {
-    std::string bytes = "aaa";
-    auto message = createDataMessage(bytes);
+    const std::string bytes = "aaa";
+    const VmsLayerAndPublisher layer_and_publisher(VmsLayer(1, 0, 1), 123);
+    auto message = CreateDataMessageWithLayerPublisherInfo(layer_and_publisher, bytes);
     auto data_str = parseData(*message);
     ASSERT_FALSE(data_str.empty());
     EXPECT_EQ(data_str, bytes);
diff --git a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
index 200dd3f..c94c825 100644
--- a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
+++ b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
@@ -1233,7 +1233,14 @@
     }
 
     if (mUseHalBufManager) {
-        returnStreamBuffers(results.outputBuffers);
+        // Don't return buffers of bufId 0 (empty buffer)
+        std::vector<StreamBuffer> buffers;
+        for (const auto& sb : results.outputBuffers) {
+            if (sb.bufferId != 0) {
+                buffers.push_back(sb);
+            }
+        }
+        returnStreamBuffers(buffers);
     }
     return notify;
 }
diff --git a/current.txt b/current.txt
index 6510134..47e7d72 100644
--- a/current.txt
+++ b/current.txt
@@ -546,6 +546,7 @@
 08d439c463e4044fa78874037d8e8379aa3cabecde32f08a775897eea5a538af android.hardware.secure_element@1.1::ISecureElement
 b53ac9d61c24efb16a2d63a861cef20680f6d57adb244a03b9778c675550628b android.hardware.secure_element@1.1::ISecureElementHalCallback
 3702b1c52c0bb3427244618e9e7975c05228bf4ceb8720da7a93603a71cb0368 android.hardware.sensors@2.0::ISensors
+c36670945ea09d92ae90a557147352ed9bd5223f957d347b367c2acb6f94870f android.hardware.sensors@2.0::ISensors # b/135216821
 ae5faa38538a9f50eb71eb7f9b998271124d2c64b761cb11c4d820c7732b4ddc android.hardware.sensors@2.0::ISensorsCallback
 3a98242a57d0820dacaca0f7db52bec433eae1f21c498763c6f1ece611c3967b android.hardware.sensors@2.0::types
 ce4b98211959449361146d4b1e5554dc841ceb4d4577154d7b2fb6d1eb504f76 android.hardware.soundtrigger@2.2::ISoundTriggerHw
diff --git a/radio/1.2/vts/functional/radio_hidl_hal_api.cpp b/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
index 63d3187..f11f0d8 100644
--- a/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
@@ -60,6 +60,11 @@
                                      {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED,
                                       RadioError::OPERATION_NOT_ALLOWED}));
     }
+
+    if (radioRsp_v1_2->rspInfo.error == RadioError::NONE) {
+        ALOGI("Stop Network Scan");
+        stopNetworkScan();
+    }
 }
 
 /*
diff --git a/radio/1.2/vts/functional/radio_hidl_hal_test.cpp b/radio/1.2/vts/functional/radio_hidl_hal_test.cpp
index b34f138..bff7481 100644
--- a/radio/1.2/vts/functional/radio_hidl_hal_test.cpp
+++ b/radio/1.2/vts/functional/radio_hidl_hal_test.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <android/hardware/radio/1.1/IRadio.h>
 #include <radio_hidl_hal_utils_v1_2.h>
 
 void RadioHidlTest_v1_2::SetUp() {
@@ -84,4 +85,28 @@
     serial = GetRandomSerialNumber();
     radio_v1_2->getIccCardStatus(serial);
     EXPECT_EQ(std::cv_status::no_timeout, wait());
-}
\ No newline at end of file
+}
+
+void RadioHidlTest_v1_2::stopNetworkScan() {
+    sp<::android::hardware::radio::V1_1::IRadio> radio_v1_1;
+
+    radio_v1_1 = ::testing::VtsHalHidlTargetTestBase::getService<
+            ::android::hardware::radio::V1_1::IRadio>(
+            RadioHidlEnvironment::Instance()
+                    ->getServiceName<::android::hardware::radio::V1_1::IRadio>(
+                            hidl_string(RADIO_SERVICE_NAME)));
+    if (radio_v1_1 == NULL) {
+        sleep(60);
+        radio_v1_1 = ::testing::VtsHalHidlTargetTestBase::getService<
+                ::android::hardware::radio::V1_1::IRadio>(
+                RadioHidlEnvironment::Instance()
+                        ->getServiceName<::android::hardware::radio::V1_1::IRadio>(
+                                hidl_string(RADIO_SERVICE_NAME)));
+    }
+    ASSERT_NE(nullptr, radio_v1_1.get());
+
+    serial = GetRandomSerialNumber();
+
+    radio_v1_1->stopNetworkScan(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+}
diff --git a/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h b/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h
index 2e65bfb..3f780e5 100644
--- a/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h
+++ b/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h
@@ -622,7 +622,10 @@
     /* Update Sim Card Status */
     void updateSimCardStatus();
 
-   public:
+    /* Stop Network Scan Command */
+    void stopNetworkScan();
+
+  public:
     virtual void SetUp() override;
 
     /* Used as a mechanism to inform the test about data/event callback */
diff --git a/sensors/2.0/ISensors.hal b/sensors/2.0/ISensors.hal
index 3a9af46..a84c56e 100644
--- a/sensors/2.0/ISensors.hal
+++ b/sensors/2.0/ISensors.hal
@@ -99,7 +99,11 @@
      * Lock FMQ. When the HAL reads the data from the Wake Lock FMQ, the HAL
      * decrements its current count of unprocessed WAKE_UP events and releases
      * its wake_lock if the current count of unprocessed WAKE_UP events is
-     * zero.
+     * zero. It is important to note that the HAL must acquire the wake lock and
+     * update its internal state regarding the number of outstanding WAKE_UP
+     * events _before_ posting the event to the Wake Lock FMQ, in order to avoid
+     * a race condition that can lead to loss of wake lock synchronization with
+     * the framework.
      *
      * The framework must use the WakeLockQueueFlagBits::DATA_WRITTEN value to
      * notify the HAL that data has been written to the Wake Lock FMQ and must
diff --git a/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp b/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp
index 5f71654..0525bdc 100644
--- a/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp
+++ b/sensors/2.0/vts/functional/SensorsHidlEnvironmentV2_0.cpp
@@ -139,6 +139,7 @@
     size_t eventsToRead = std::min(availableEvents, mEventBuffer.size());
     if (eventsToRead > 0) {
         if (mEventQueue->read(mEventBuffer.data(), eventsToRead)) {
+            mEventQueueFlag->wake(asBaseType(EventQueueFlagBits::EVENTS_READ));
             for (size_t i = 0; i < eventsToRead; i++) {
                 addEvent(mEventBuffer[i]);
             }