diff --git a/audio/common/all-versions/default/7.0/HidlUtils.cpp b/audio/common/all-versions/default/7.0/HidlUtils.cpp
index 0fd2947..f89c898 100644
--- a/audio/common/all-versions/default/7.0/HidlUtils.cpp
+++ b/audio/common/all-versions/default/7.0/HidlUtils.cpp
@@ -898,7 +898,7 @@
     for (const auto& transport : transports) {
         switch (transport.audioCapability.getDiscriminator()) {
             case AudioTransport::AudioCapability::hidl_discriminator::profile:
-                if (halPort->num_audio_profiles > AUDIO_PORT_MAX_AUDIO_PROFILES) {
+                if (halPort->num_audio_profiles >= AUDIO_PORT_MAX_AUDIO_PROFILES) {
                     ALOGE("%s, too many audio profiles", __func__);
                     result = BAD_VALUE;
                     break;
@@ -914,7 +914,8 @@
                                 result);
                 break;
             case AudioTransport::AudioCapability::hidl_discriminator::edid:
-                if (halPort->num_extra_audio_descriptors > AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {
+                if (halPort->num_extra_audio_descriptors >=
+                    AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS) {
                     ALOGE("%s, too many extra audio descriptors", __func__);
                     result = BAD_VALUE;
                     break;
diff --git a/audio/common/all-versions/default/tests/hidlutils_tests.cpp b/audio/common/all-versions/default/tests/hidlutils_tests.cpp
index f718e7a..93688fc 100644
--- a/audio/common/all-versions/default/tests/hidlutils_tests.cpp
+++ b/audio/common/all-versions/default/tests/hidlutils_tests.cpp
@@ -954,6 +954,18 @@
     EXPECT_TRUE(audio_port_configs_are_equal(&halConfig, &halConfigBack));
 }
 
+static AudioProfile generateValidAudioProfile() {
+    AudioProfile profile;
+    profile.format = toString(xsd::AudioFormat::AUDIO_FORMAT_PCM_16_BIT);
+    profile.sampleRates.resize(2);
+    profile.sampleRates[0] = 44100;
+    profile.sampleRates[1] = 48000;
+    profile.channelMasks.resize(2);
+    profile.channelMasks[0] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_MONO);
+    profile.channelMasks[1] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO);
+    return profile;
+}
+
 TEST(HidlUtils, ConvertInvalidAudioTransports) {
     hidl_vec<AudioTransport> invalid;
     struct audio_port_v7 halInvalid = {};
@@ -973,20 +985,32 @@
     invalid[0].audioCapability.edid(hidl_vec<uint8_t>(EXTRA_AUDIO_DESCRIPTOR_SIZE + 1));
     invalid[1].encapsulationType = "random string";
     EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
+
+    // The size of audio profile must not be greater than the maximum value.
+    invalid.resize(0);
+    invalid.resize(AUDIO_PORT_MAX_AUDIO_PROFILES + 1);
+    for (size_t i = 0; i < invalid.size(); ++i) {
+        invalid[i].audioCapability.profile(generateValidAudioProfile());
+        invalid[i].encapsulationType =
+                toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_NONE);
+    }
+    EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
+
+    // The size of extra audio descriptors must not be greater than the maximum value.
+    invalid.resize(0);
+    invalid.resize(AUDIO_PORT_MAX_EXTRA_AUDIO_DESCRIPTORS + 1);
+    for (size_t i = 0; i < invalid.size(); ++i) {
+        invalid[i].audioCapability.edid({0x11, 0x06, 0x01});
+        invalid[i].encapsulationType =
+                toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_IEC61937);
+    }
+    EXPECT_EQ(BAD_VALUE, HidlUtils::audioTransportsToHal(invalid, &halInvalid));
 }
 
 TEST(HidlUtils, ConvertAudioTransports) {
     hidl_vec<AudioTransport> transports;
     transports.resize(2);
-    AudioProfile profile;
-    profile.format = toString(xsd::AudioFormat::AUDIO_FORMAT_PCM_16_BIT);
-    profile.sampleRates.resize(2);
-    profile.sampleRates[0] = 44100;
-    profile.sampleRates[1] = 48000;
-    profile.channelMasks.resize(2);
-    profile.channelMasks[0] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_MONO);
-    profile.channelMasks[1] = toString(xsd::AudioChannelMask::AUDIO_CHANNEL_OUT_STEREO);
-    transports[0].audioCapability.profile(profile);
+    transports[0].audioCapability.profile(generateValidAudioProfile());
     hidl_vec<uint8_t> shortAudioDescriptor({0x11, 0x06, 0x01});
     transports[0].encapsulationType =
             toString(xsd::AudioEncapsulationType::AUDIO_ENCAPSULATION_TYPE_NONE);
diff --git a/confirmationui/aidl/vts/functional/VtsHalConfirmationUITargetTest.cpp b/confirmationui/aidl/vts/functional/VtsHalConfirmationUITargetTest.cpp
index bf1f1c8..61dae8b 100644
--- a/confirmationui/aidl/vts/functional/VtsHalConfirmationUITargetTest.cpp
+++ b/confirmationui/aidl/vts/functional/VtsHalConfirmationUITargetTest.cpp
@@ -266,7 +266,7 @@
     static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + 3);
     ASSERT_TRUE(confirmator_->promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}).isOk());
     // Simulate the user taping ok.
@@ -309,7 +309,7 @@
     static constexpr char test_prompt[] = "D\'oh!";
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + sizeof(test_extra));
     auto result = confirmator_->promptUserConfirmation(conf_cb, prompt_text, extra, "en", {});
     ASSERT_EQ(IConfirmationUI::UI_ERROR_MESSAGE_TOO_LONG, getReturnCode(result));
@@ -322,7 +322,7 @@
     static constexpr char test_prompt[] = "D\'oh!";
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + sizeof(test_extra));
     auto result = confirmator_->promptUserConfirmation(conf_cb, prompt_text, extra, "en", {});
     ASSERT_EQ(IConfirmationUI::UI_ERROR_MESSAGE_TOO_LONG, getReturnCode(result));
@@ -334,7 +334,7 @@
     static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + 3);
     ASSERT_TRUE(confirmator_->promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}).isOk());
 
@@ -355,7 +355,7 @@
     static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + 3);
     ASSERT_TRUE(confirmator_->promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}).isOk());
 
@@ -377,7 +377,7 @@
     static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + 3);
     ASSERT_TRUE(confirmator_->promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}).isOk());
 
@@ -399,7 +399,7 @@
     static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + 3);
     ASSERT_TRUE(confirmator_
                         ->promptUserConfirmation(conf_cb, prompt_text, extra, "en",
@@ -424,7 +424,7 @@
     static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + 3);
     ASSERT_TRUE(confirmator_->promptUserConfirmation(conf_cb, prompt_text, extra, "en", {}).isOk());
 
@@ -446,7 +446,7 @@
     static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + 3);
     ASSERT_TRUE(confirmator_
                         ->promptUserConfirmation(conf_cb, prompt_text, extra, "en",
@@ -469,7 +469,7 @@
     static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + 3);
     auto result = confirmator_->promptUserConfirmation(conf_cb, prompt_text, extra, "en", {});
     ASSERT_EQ(IConfirmationUI::UI_ERROR_MALFORMED_UTF8ENCODING, getReturnCode(result));
@@ -483,7 +483,7 @@
     static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + 3);
     auto result = confirmator_->promptUserConfirmation(conf_cb, prompt_text, extra, "en", {});
     ASSERT_EQ(IConfirmationUI::UI_ERROR_MALFORMED_UTF8ENCODING, getReturnCode(result));
@@ -496,7 +496,7 @@
     static constexpr uint8_t test_extra[] = {0x1, 0x2, 0x3};
     shared_ptr<ConfirmationTestCallback> conf_cb =
             ::ndk::SharedRefBase::make<ConfirmationTestCallback>(*this);
-    vector<uint8_t> prompt_text(test_prompt, test_prompt + sizeof(test_prompt));
+    vector<uint8_t> prompt_text(test_prompt, test_prompt + strlen(test_prompt));
     vector<uint8_t> extra(test_extra, test_extra + 3);
     auto result = confirmator_->promptUserConfirmation(conf_cb, prompt_text, extra, "en", {});
     ASSERT_EQ(IConfirmationUI::UI_ERROR_MALFORMED_UTF8ENCODING, getReturnCode(result));
diff --git a/security/keymint/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl b/security/keymint/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
index 3f1f2f7..77df99f 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
@@ -29,7 +29,7 @@
  * validate the request and create certificates.
  *
  * This interface does not provide any way to use the generated and certified key pairs. It's
- * intended to be implemented by a HAL service that does other things with keys (e.g. Keymint).
+ * intended to be implemented by a HAL service that does other things with keys (e.g. KeyMint).
  *
  * The root of trust for secure provisioning is something called the Device Identifier Composition
  * Engine (DICE) Chain. The DICE Chain is a chain of certificates, represented as COSE_Sign1 objects
@@ -79,9 +79,9 @@
  * While a proper DICE Chain, as described above, reflects the complete boot sequence from boot ROM
  * to the secure area image of the IRemotelyProvisionedComponent, it's also possible to use a
  * "degenerate" DICE Chain which consists only of a single, self-signed certificate containing the
- * public key of a hardware-bound key pair. This is an appopriate solution for devices which haven't
- * implemented everything necessary to produce a proper DICE Chain, but can derive a unique key pair
- * in the secure area. In this degenerate case, UDS_Pub is the same as CDI_Leaf_Pub.
+ * public key of a hardware-bound key pair. This is an appropriate solution for devices which
+ * haven't implemented everything necessary to produce a proper DICE Chain, but can derive a unique
+ * key pair in the secure area. In this degenerate case, UDS_Pub is the same as CDI_Leaf_Pub.
  *
  * DICE Chain Privacy
  * ==================
@@ -171,7 +171,7 @@
      *        If testMode is false, the keysToCertify array must not contain any keys flagged as
      *        test keys. Otherwise, the method must return STATUS_TEST_KEY_IN_PRODUCTION_REQUEST.
      *
-     * @param in endpointEncryptionKey contains an X22519 public key which will be used to encrypt
+     * @param in endpointEncryptionKey contains an X25519 public key which will be used to encrypt
      *        the BCC. For flexibility, this is represented as a certificate chain, represented as a
      *        CBOR array of COSE_Sign1 objects, ordered from root to leaf. The leaf contains the
      *        X25519 encryption key, each other element is an Ed25519 key signing the next in the
@@ -198,7 +198,7 @@
      *                 -2 : bstr                      ; Ed25519 public key
      *            }
      *
-     *            SignatureKeyP256 = {
+     *            SignatureKeyP256 = {                ; COSE_Key
      *                 1 : 2,                         ; Key type : EC2
      *                 3 : AlgorithmES256,            ; Algorithm
      *                 -1 : 1,                        ; Curve: P256
@@ -228,7 +228,7 @@
      *                2 : bstr             ; KID : EEK ID
      *                3 : -25,             ; Algorithm : ECDH-ES + HKDF-256
      *                -1 : 4,              ; Curve : X25519
-     *                -2 : bstr            ; Ed25519 public key
+     *                -2 : bstr            ; X25519 public key
      *            }
      *
      *            EekP256 = {              ; COSE_Key
@@ -247,8 +247,8 @@
      *                payload: bstr .cbor EekX25519 / .cbor EekP256
      *            ]
      *
-     *            AlgorithmES256 = -7
-     *            AlgorithmEdDSA = -8
+     *            AlgorithmES256 = -7      ; RFC 8152 section 8.1
+     *            AlgorithmEdDSA = -8      ; RFC 8152 section 8.2
      *
      *        If the contents of endpointEncryptionKey do not match the SignedEek structure above,
      *        the method must return STATUS_INVALID_EEK.
@@ -257,7 +257,7 @@
      *        in the chain, which implies that it must not attempt to validate the signature.
      *
      *        If testMode is false, the method must validate the chain signatures, and must verify
-     *        that the public key in the root certifictate is in its pre-configured set of
+     *        that the public key in the root certificate is in its pre-configured set of
      *        authorized EEK root keys. If the public key is not in the database, or if signature
      *        verification fails, the method must return STATUS_INVALID_EEK.
      *
@@ -271,7 +271,7 @@
      * @param out ProtectedData contains the encrypted BCC and the ephemeral MAC key used to
      *        authenticate the keysToSign (see keysToSignMac output argument).
      *
-     * @return The of KeysToSign in the CertificateRequest structure. Specifically, it contains:
+     * @return The MAC of KeysToSign in the CertificateRequest structure. Specifically, it contains:
      *
      *            HMAC-256(EK_mac, .cbor KeysToMacStructure)
      *
@@ -366,7 +366,7 @@
      *                              ; intermediate certificates between Root and Leaf.
      * ]
      *
-     * ; A bstr containing a DER-encoded X.509 certificate (RSA, NIST P-curve, or edDSA)
+     * ; A bstr containing a DER-encoded X.509 certificate (RSA, NIST P-curve, or EdDSA)
      * X509Certificate = bstr
      *
      * ; The DICE Chain contains measurements about the device firmware.