diff --git a/bluetooth/audio/aidl/default/A2dpOffloadCodecSbc.cpp b/bluetooth/audio/aidl/default/A2dpOffloadCodecSbc.cpp
index 6b9046c..910f8c3 100644
--- a/bluetooth/audio/aidl/default/A2dpOffloadCodecSbc.cpp
+++ b/bluetooth/audio/aidl/default/A2dpOffloadCodecSbc.cpp
@@ -486,7 +486,7 @@
   }
 
   min_bitpool = std::max(min_bitpool, uint8_t(lcaps.get(kMinimumBitpool)));
-  max_bitpool = std::max(max_bitpool, uint8_t(lcaps.get(kMaximumBitpool)));
+  max_bitpool = std::min(max_bitpool, uint8_t(lcaps.get(kMaximumBitpool)));
 
   if (hint) {
     min_bitpool =
diff --git a/bluetooth/socket/aidl/android/hardware/bluetooth/socket/LeCocCapabilities.aidl b/bluetooth/socket/aidl/android/hardware/bluetooth/socket/LeCocCapabilities.aidl
index 003da11..9cd63d6 100644
--- a/bluetooth/socket/aidl/android/hardware/bluetooth/socket/LeCocCapabilities.aidl
+++ b/bluetooth/socket/aidl/android/hardware/bluetooth/socket/LeCocCapabilities.aidl
@@ -37,8 +37,9 @@
     /**
      * The value used by the Host stack for the local Maximum Packet Size shall be the value
      * LE_ACL_Data_Packet_Length returned by the controller in response to the command HCI LE Read
-     * Buffer Size. Then, the MPS size must be in range 1 to 255. We do not make the MPS
-     * configurable in HAL because using the maximum value does not require a large amount of
-     * memory.
+     * Buffer Size if Total_Num_LE_ACL_Data_Packets is not zero. The MPS shall be the value
+     * ACL_Data_Packet_Length returned in response to the command HCI Read Buffer Size if
+     * Total_Num_LE_ACL_Data_Packets is zero. We do not make the MPS configurable in HAL because
+     * using the maximum value does not require a large amount of memory.
      */
 }
diff --git a/configstore/OWNERS b/configstore/OWNERS
index 70ad434..74789b5 100644
--- a/configstore/OWNERS
+++ b/configstore/OWNERS
@@ -1,3 +1,2 @@
 # Bug component: 24939
 
-lpy@google.com
diff --git a/confirmationui/1.0/default/OWNERS b/confirmationui/1.0/default/OWNERS
index 17aed51..d8b8840 100644
--- a/confirmationui/1.0/default/OWNERS
+++ b/confirmationui/1.0/default/OWNERS
@@ -1,3 +1,2 @@
 # Bug component: 1124672
-jdanis@google.com
 swillden@google.com
diff --git a/confirmationui/1.0/vts/OWNERS b/confirmationui/1.0/vts/OWNERS
index aa07242..b0ee996 100644
--- a/confirmationui/1.0/vts/OWNERS
+++ b/confirmationui/1.0/vts/OWNERS
@@ -1,4 +1,3 @@
 # Bug component: 1124672
-jdanis@google.com
 swillden@google.com
 yim@google.com
diff --git a/confirmationui/support/OWNERS b/confirmationui/support/OWNERS
index 17aed51..d8b8840 100644
--- a/confirmationui/support/OWNERS
+++ b/confirmationui/support/OWNERS
@@ -1,3 +1,2 @@
 # Bug component: 1124672
-jdanis@google.com
 swillden@google.com
diff --git a/gatekeeper/1.0/default/OWNERS b/gatekeeper/1.0/default/OWNERS
index c97fba6..d552a9a 100644
--- a/gatekeeper/1.0/default/OWNERS
+++ b/gatekeeper/1.0/default/OWNERS
@@ -1,3 +1,2 @@
 # Bug component: 1124862
-jdanis@google.com
 swillden@google.com
diff --git a/gatekeeper/1.0/software/OWNERS b/gatekeeper/1.0/software/OWNERS
index c97fba6..d552a9a 100644
--- a/gatekeeper/1.0/software/OWNERS
+++ b/gatekeeper/1.0/software/OWNERS
@@ -1,3 +1,2 @@
 # Bug component: 1124862
-jdanis@google.com
 swillden@google.com
diff --git a/nfc/aidl/vts/functional/VtsNfcBehaviorChangesTest.cpp b/nfc/aidl/vts/functional/VtsNfcBehaviorChangesTest.cpp
index 9c44c3a..d3fcbb3 100644
--- a/nfc/aidl/vts/functional/VtsNfcBehaviorChangesTest.cpp
+++ b/nfc/aidl/vts/functional/VtsNfcBehaviorChangesTest.cpp
@@ -153,8 +153,7 @@
                     SyncEventGuard guard(sNfaVsCommand);
                     sNfaVsCommand.notifyOne();
                 } break;
-                case NCI_ANDROID_SET_PASSIVE_OBSERVER_TECH:
-                case NCI_ANDROID_PASSIVE_OBSERVE: {
+                case NCI_ANDROID_SET_PASSIVE_OBSERVER_TECH: {
                     if (param_len == 5) {
                         if ((p_param[0] & NCI_MT_MASK) == (NCI_MT_RSP << NCI_MT_SHIFT)) {
                             sVSCmdStatus = p_param[4];
@@ -190,36 +189,6 @@
 }
 
 /*
- * Enable passive observe mode.
- */
-tNFA_STATUS static nfaObserveModeEnable(bool enable) {
-    tNFA_STATUS status = NFA_STATUS_FAILED;
-
-    status = NFA_StopRfDiscovery();
-    if (status == NFA_STATUS_OK) {
-        if (!sNfaEnableDisablePollingEvent.wait(1000)) {
-            LOG(WARNING) << "Timeout waiting to disable NFC RF discovery";
-            return NFA_STATUS_TIMEOUT;
-        }
-    }
-
-    uint8_t cmd[] = {NCI_ANDROID_PASSIVE_OBSERVE,
-                     static_cast<uint8_t>(enable ? NCI_ANDROID_PASSIVE_OBSERVE_PARAM_ENABLE
-                                                 : NCI_ANDROID_PASSIVE_OBSERVE_PARAM_DISABLE)};
-
-    status = NFA_SendVsCommand(NCI_MSG_PROP_ANDROID, sizeof(cmd), cmd, nfaVSCallback);
-
-    if (status == NFA_STATUS_OK) {
-        if (!sNfaVsCommand.wait(1000)) {
-            LOG(WARNING) << "Timeout waiting for set observe mode command response";
-            return NFA_STATUS_TIMEOUT;
-        }
-    }
-
-    return status;
-}
-
-/*
  * Get observe mode state.
  */
 tNFA_STATUS static nfaQueryObserveModeState() {
@@ -322,33 +291,6 @@
 };
 
 /*
- * ObserveModeEnableDisable:
- * Attempts to enable observe mode. Does not test Observe Mode functionality,
- * but simply verifies that the enable command responds successfully.
- *
- * @VsrTest = GMS-VSR-3.2.8-001
- */
-TEST_P(NfcBehaviorChanges, ObserveModeEnableDisable) {
-    if (get_vsr_api_level() < 202404) {
-        GTEST_SKIP() << "Skipping test for board API level < 202404";
-    }
-
-    tNFA_STATUS status = nfaObserveModeEnable(true);
-    ASSERT_EQ(status, NFA_STATUS_OK);
-
-    status = nfaQueryObserveModeState();
-    ASSERT_EQ(status, NFA_STATUS_OK);
-    ASSERT_NE(sObserveModeState, 0);
-
-    status = nfaObserveModeEnable(false);
-    ASSERT_EQ(status, NFA_STATUS_OK);
-
-    status = nfaQueryObserveModeState();
-    ASSERT_EQ(status, NFA_STATUS_OK);
-    ASSERT_EQ(sObserveModeState, 0);
-}
-
-/*
  * SetPassiveObserverTech_getCaps:
  * Verifies GET_CAPS returns get correct value for observe mode capabilities.
  */
diff --git a/power/1.1/vts/functional/OWNERS b/power/1.1/vts/functional/OWNERS
index 6de2cd5..53948b9 100644
--- a/power/1.1/vts/functional/OWNERS
+++ b/power/1.1/vts/functional/OWNERS
@@ -1,2 +1 @@
 # Bug component: 158088
-connoro@google.com
diff --git a/threadnetwork/aidl/default/Android.bp b/threadnetwork/aidl/default/Android.bp
index a840fa3..481f027 100644
--- a/threadnetwork/aidl/default/Android.bp
+++ b/threadnetwork/aidl/default/Android.bp
@@ -45,6 +45,41 @@
     ],
 }
 
+cc_library_static {
+    name: "android.hardware.threadnetwork.lib",
+
+    vendor: true,
+    export_include_dirs: ["."],
+
+    defaults: ["android.hardware.threadnetwork-service.defaults"],
+
+    srcs: [
+        "service.cpp",
+        "thread_chip.cpp",
+        "utils.cpp",
+    ],
+
+    shared_libs: [
+        "libbinder_ndk",
+        "liblog",
+    ],
+
+    static_libs: [
+        "android.hardware.threadnetwork-V1-ndk",
+        "libbase",
+        "libcutils",
+        "libutils",
+        "openthread-common",
+        "openthread-hdlc",
+        "openthread-platform",
+        "openthread-posix",
+        "openthread-spi",
+        "openthread-url",
+    ],
+
+    stl: "c++_static",
+}
+
 cc_defaults {
     name: "android.hardware.threadnetwork-service.defaults",
     product_variables: {
diff --git a/threadnetwork/aidl/default/thread_chip.cpp b/threadnetwork/aidl/default/thread_chip.cpp
index e312728..ba0baf2 100644
--- a/threadnetwork/aidl/default/thread_chip.cpp
+++ b/threadnetwork/aidl/default/thread_chip.cpp
@@ -83,6 +83,11 @@
                 mRxFrameBuffer.GetFrame(), mRxFrameBuffer.GetFrame() + mRxFrameBuffer.GetLength()));
     }
 
+    if (mVendorCallback != nullptr) {
+        mVendorCallback->onReceiveSpinelFrame(std::vector<uint8_t>(
+                mRxFrameBuffer.GetFrame(), mRxFrameBuffer.GetFrame() + mRxFrameBuffer.GetLength()));
+    }
+
     mRxFrameBuffer.DiscardFrame();
 }
 
@@ -193,6 +198,10 @@
     }
 }
 
+void ThreadChip::setVendorCallback(const std::shared_ptr<IThreadChipCallback>& vendorCallback) {
+    mVendorCallback = vendorCallback;
+}
+
 ndk::ScopedAStatus ThreadChip::errorStatus(int32_t error, const char* message) {
     return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage(error, message));
 }
diff --git a/threadnetwork/aidl/default/thread_chip.hpp b/threadnetwork/aidl/default/thread_chip.hpp
index d07d049..6f23efe 100644
--- a/threadnetwork/aidl/default/thread_chip.hpp
+++ b/threadnetwork/aidl/default/thread_chip.hpp
@@ -43,6 +43,7 @@
     ndk::ScopedAStatus hardwareReset() override;
     void Update(otSysMainloopContext& context) override;
     void Process(const otSysMainloopContext& context) override;
+    void setVendorCallback(const std::shared_ptr<IThreadChipCallback>& vendorCallback);
 
   private:
     static void onBinderDiedJump(void* context);
@@ -59,6 +60,7 @@
     std::shared_ptr<ot::Spinel::SpinelInterface> mSpinelInterface;
     ot::Spinel::SpinelInterface::RxFrameBuffer mRxFrameBuffer;
     std::shared_ptr<IThreadChipCallback> mCallback;
+    std::shared_ptr<IThreadChipCallback> mVendorCallback;
     ::ndk::ScopedAIBinder_DeathRecipient mDeathRecipient;
 };