diff --git a/audio/2.0/default/Stream.h b/audio/2.0/default/Stream.h
index 82f05a7..e29af53 100644
--- a/audio/2.0/default/Stream.h
+++ b/audio/2.0/default/Stream.h
@@ -49,6 +49,13 @@
 struct Stream : public IStream, public ParametersUtil {
     explicit Stream(audio_stream_t* stream);
 
+    /** 1GiB is the maximum buffer size the HAL client is allowed to request.
+     * This value has been chosen to be under SIZE_MAX and still big enough
+     * for all audio use case.
+     * Keep private for 2.0, put in .hal in 2.1
+     */
+    static constexpr uint32_t MAX_BUFFER_SIZE = 2 << 30 /* == 1GiB */;
+
     // Methods from ::android::hardware::audio::V2_0::IStream follow.
     Return<uint64_t> getFrameSize()  override;
     Return<uint64_t> getFrameCount()  override;
diff --git a/audio/2.0/default/StreamIn.cpp b/audio/2.0/default/StreamIn.cpp
index b81cbb9..9c933a9 100644
--- a/audio/2.0/default/StreamIn.cpp
+++ b/audio/2.0/default/StreamIn.cpp
@@ -347,14 +347,10 @@
         sendError(Result::INVALID_ARGUMENTS);
         return Void();
     }
-    // A message queue asserts if it can not handle the requested buffer,
-    // thus the client has to guess the maximum size it can handle
-    // Choose an arbitrary margin for the overhead of a message queue
-    size_t metadataOverhead = 100000;
-    if (frameSize >
-        (std::numeric_limits<size_t>::max() - metadataOverhead) / framesCount) {
-        ALOGE("Buffer too big: %u*%u bytes can not fit in a message queue",
-              frameSize, framesCount);
+
+    if (frameSize > Stream::MAX_BUFFER_SIZE / framesCount) {
+        ALOGE("Buffer too big: %u*%u bytes > MAX_BUFFER_SIZE (%u)", frameSize, framesCount,
+              Stream::MAX_BUFFER_SIZE);
         sendError(Result::INVALID_ARGUMENTS);
         return Void();
     }
diff --git a/audio/2.0/default/StreamOut.cpp b/audio/2.0/default/StreamOut.cpp
index 290d0b1..22dcd0c 100644
--- a/audio/2.0/default/StreamOut.cpp
+++ b/audio/2.0/default/StreamOut.cpp
@@ -323,14 +323,9 @@
         sendError(Result::INVALID_ARGUMENTS);
         return Void();
     }
-    // A message queue asserts if it can not handle the requested buffer,
-    // thus the client has to guess the maximum size it can handle
-    size_t metadataOverhead =
-        100000;  // Arbitrary margin for the overhead of a message queue
-    if (frameSize >
-        (std::numeric_limits<size_t>::max() - metadataOverhead) / framesCount) {
-        ALOGE("Buffer too big: %u*%u bytes can not fit in a message queue",
-              frameSize, framesCount);
+    if (frameSize > Stream::MAX_BUFFER_SIZE / framesCount) {
+        ALOGE("Buffer too big: %u*%u bytes > MAX_BUFFER_SIZE (%u)", frameSize, framesCount,
+              Stream::MAX_BUFFER_SIZE);
         sendError(Result::INVALID_ARGUMENTS);
         return Void();
     }
diff --git a/cas/1.0/vts/functional/Android.bp b/cas/1.0/vts/functional/Android.bp
index 872bb2c..e1e09e9 100644
--- a/cas/1.0/vts/functional/Android.bp
+++ b/cas/1.0/vts/functional/Android.bp
@@ -25,5 +25,8 @@
         "android.hidl.memory@1.0",
         "libhidlmemory",
     ],
+    shared_libs: [
+        "libbinder",
+    ],
 }
 
diff --git a/cas/1.0/vts/functional/VtsHalCasV1_0TargetTest.cpp b/cas/1.0/vts/functional/VtsHalCasV1_0TargetTest.cpp
index 062ee20..d3b0f1d 100644
--- a/cas/1.0/vts/functional/VtsHalCasV1_0TargetTest.cpp
+++ b/cas/1.0/vts/functional/VtsHalCasV1_0TargetTest.cpp
@@ -25,12 +25,10 @@
 #include <android/hardware/cas/1.0/types.h>
 #include <android/hardware/cas/native/1.0/IDescrambler.h>
 #include <android/hardware/cas/native/1.0/types.h>
-#include <android/hidl/allocator/1.0/IAllocator.h>
-#include <android/hidl/memory/1.0/IMapper.h>
+#include <binder/MemoryDealer.h>
 #include <hidl/HidlSupport.h>
 #include <hidl/HidlTransportSupport.h>
 #include <hidl/Status.h>
-#include <hidlmemory/mapping.h>
 #include <utils/Condition.h>
 #include <utils/Mutex.h>
 
@@ -69,9 +67,9 @@
 using android::hardware::hidl_memory;
 using android::hardware::Return;
 using android::hardware::cas::V1_0::Status;
-using android::hidl::allocator::V1_0::IAllocator;
-using android::hidl::memory::V1_0::IMemory;
-using android::hidl::memory::V1_0::IMapper;
+using android::IMemory;
+using android::IMemoryHeap;
+using android::MemoryDealer;
 using android::Mutex;
 using android::sp;
 
@@ -230,7 +228,7 @@
     ::testing::AssertionResult openCasSession(std::vector<uint8_t>* sessionId);
     ::testing::AssertionResult descrambleTestInputBuffer(const sp<IDescrambler>& descrambler,
                                                          Status* descrambleStatus,
-                                                         hidl_memory* hidlInMemory);
+                                                         sp<IMemory>* hidlInMemory);
 };
 
 ::testing::AssertionResult MediaCasHidlTest::createCasPlugin(int32_t caSystemId) {
@@ -271,34 +269,48 @@
 }
 
 ::testing::AssertionResult MediaCasHidlTest::descrambleTestInputBuffer(
-    const sp<IDescrambler>& descrambler, Status* descrambleStatus, hidl_memory* hidlInMemory) {
+    const sp<IDescrambler>& descrambler, Status* descrambleStatus, sp<IMemory>* inMemory) {
     hidl_vec<SubSample> hidlSubSamples;
     hidlSubSamples.setToExternal(const_cast<SubSample*>(kSubSamples),
                                  (sizeof(kSubSamples) / sizeof(SubSample)), false /*own*/);
-    sp<IAllocator> allocator = IAllocator::getService("ashmem");
-    if (nullptr == allocator.get()) {
+
+    sp<MemoryDealer> dealer = new MemoryDealer(sizeof(kInBinaryBuffer), "vts-cas");
+    if (nullptr == dealer.get()) {
+        ALOGE("couldn't get MemoryDealer!");
         return ::testing::AssertionFailure();
     }
 
-    bool allocateStatus;
-    auto returnStatus =
-        allocator->allocate(sizeof(kInBinaryBuffer), [&](bool status, hidl_memory const& mem) {
-            allocateStatus = status;
-            *hidlInMemory = mem;
-        });
-    if (!returnStatus.isOk() || !allocateStatus) {
+    sp<IMemory> mem = dealer->allocate(sizeof(kInBinaryBuffer));
+    if (nullptr == mem.get()) {
+        ALOGE("couldn't allocate IMemory!");
         return ::testing::AssertionFailure();
     }
-    android::sp<IMemory> inMemory = mapMemory(*hidlInMemory);
-    if (nullptr == inMemory.get()) {
+    *inMemory = mem;
+
+    // build hidl_memory from memory heap
+    ssize_t offset;
+    size_t size;
+    sp<IMemoryHeap> heap = mem->getMemory(&offset, &size);
+    if (nullptr == heap.get()) {
+        ALOGE("couldn't get memory heap!");
         return ::testing::AssertionFailure();
     }
 
-    uint8_t* ipBuffer = static_cast<uint8_t*>(static_cast<void*>(inMemory->getPointer()));
+    native_handle_t* nativeHandle = native_handle_create(1, 0);
+    if (!nativeHandle) {
+        ALOGE("failed to create native handle!");
+        return ::testing::AssertionFailure();
+    }
+    nativeHandle->data[0] = heap->getHeapID();
+
+    uint8_t* ipBuffer = static_cast<uint8_t*>(static_cast<void*>(mem->pointer()));
     memcpy(ipBuffer, kInBinaryBuffer, sizeof(kInBinaryBuffer));
 
     SharedBuffer srcBuffer = {
-        .heapBase = *hidlInMemory, .offset = (uint64_t)0, .size = sizeof(kInBinaryBuffer)};
+            .heapBase = hidl_memory("ashmem", hidl_handle(nativeHandle), heap->getSize()),
+            .offset = (uint64_t) offset,
+            .size = (uint64_t) size
+    };
 
     DestinationBuffer dstBuffer;
     dstBuffer.type = BufferType::SHARED_MEMORY;
@@ -456,24 +468,33 @@
     EXPECT_TRUE(returnStatus.isOk());
     EXPECT_EQ(Status::OK, returnStatus);
 
+    EXPECT_FALSE(mDescramblerBase->requiresSecureDecoderComponent("video/avc"));
+
     sp<IDescrambler> descrambler;
     descrambler = IDescrambler::castFrom(mDescramblerBase);
     ASSERT_NE(descrambler, nullptr);
 
     Status descrambleStatus = Status::OK;
-    hidl_memory hidlDataMemory;
+    sp<IMemory> dataMemory;
 
-    ASSERT_TRUE(descrambleTestInputBuffer(descrambler, &descrambleStatus, &hidlDataMemory));
+    ASSERT_TRUE(descrambleTestInputBuffer(descrambler, &descrambleStatus, &dataMemory));
     EXPECT_EQ(Status::OK, descrambleStatus);
 
-    android::sp<IMemory> outMemory = mapMemory(hidlDataMemory);
-    ASSERT_NE(nullptr, outMemory.get());
-    uint8_t* opBuffer = static_cast<uint8_t*>(static_cast<void*>(outMemory->getPointer()));
+    ASSERT_NE(nullptr, dataMemory.get());
+    uint8_t* opBuffer = static_cast<uint8_t*>(static_cast<void*>(dataMemory->pointer()));
 
     int compareResult =
         memcmp(static_cast<const void*>(opBuffer), static_cast<const void*>(kOutRefBinaryBuffer),
                sizeof(kOutRefBinaryBuffer));
     EXPECT_EQ(0, compareResult);
+
+    returnStatus = mDescramblerBase->release();
+    EXPECT_TRUE(returnStatus.isOk());
+    EXPECT_EQ(Status::OK, returnStatus);
+
+    returnStatus = mMediaCas->release();
+    EXPECT_TRUE(returnStatus.isOk());
+    EXPECT_EQ(Status::OK, returnStatus);
 }
 
 TEST_F(MediaCasHidlTest, TestClearKeySessionClosedAfterRelease) {
@@ -572,9 +593,9 @@
     ASSERT_NE(descrambler, nullptr);
 
     Status descrambleStatus = Status::OK;
-    hidl_memory hidlInMemory;
+    sp<IMemory> dataMemory;
 
-    ASSERT_TRUE(descrambleTestInputBuffer(descrambler, &descrambleStatus, &hidlInMemory));
+    ASSERT_TRUE(descrambleTestInputBuffer(descrambler, &descrambleStatus, &dataMemory));
     EXPECT_EQ(Status::ERROR_CAS_DECRYPT_UNIT_NOT_INITIALIZED, descrambleStatus);
 
     // Now set a valid session, should still fail because no valid ecm is processed
@@ -582,8 +603,14 @@
     EXPECT_TRUE(returnStatus.isOk());
     EXPECT_EQ(Status::OK, returnStatus);
 
-    ASSERT_TRUE(descrambleTestInputBuffer(descrambler, &descrambleStatus, &hidlInMemory));
+    ASSERT_TRUE(descrambleTestInputBuffer(descrambler, &descrambleStatus, &dataMemory));
     EXPECT_EQ(Status::ERROR_CAS_DECRYPT, descrambleStatus);
+
+    // Verify that requiresSecureDecoderComponent handles empty mime
+    EXPECT_FALSE(mDescramblerBase->requiresSecureDecoderComponent(""));
+
+    // Verify that requiresSecureDecoderComponent handles invalid mime
+    EXPECT_FALSE(mDescramblerBase->requiresSecureDecoderComponent("bad"));
 }
 
 }  // anonymous namespace
diff --git a/keymaster/3.0/vts/functional/attestation_record.cpp b/keymaster/3.0/vts/functional/attestation_record.cpp
index 5d96fff..a428989 100644
--- a/keymaster/3.0/vts/functional/attestation_record.cpp
+++ b/keymaster/3.0/vts/functional/attestation_record.cpp
@@ -274,10 +274,12 @@
     *keymaster_security_level =
         static_cast<SecurityLevel>(ASN1_ENUMERATED_get(record->keymaster_security_level));
 
-    attestation_challenge->setToExternal(record->attestation_challenge->data,
-                                         record->attestation_challenge->length);
-
-    unique_id->setToExternal(record->unique_id->data, record->unique_id->length);
+    auto& chall = record->attestation_challenge;
+    attestation_challenge->resize(chall->length);
+    memcpy(attestation_challenge->data(), chall->data, chall->length);
+    auto& uid = record->unique_id;
+    unique_id->resize(uid->length);
+    memcpy(unique_id->data(), uid->data, uid->length);
 
     ErrorCode error = extract_auth_list(record->software_enforced, software_enforced);
     if (error != ErrorCode::OK) return error;
diff --git a/neuralnetworks/1.0/vts/functional/GeneratedTestHarness.cpp b/neuralnetworks/1.0/vts/functional/GeneratedTestHarness.cpp
index 735528b..d740b5f 100644
--- a/neuralnetworks/1.0/vts/functional/GeneratedTestHarness.cpp
+++ b/neuralnetworks/1.0/vts/functional/GeneratedTestHarness.cpp
@@ -46,11 +46,11 @@
 using ::generated_tests::Quant8Operands;
 using ::generated_tests::compare;
 
-template <typename ty>
+template <typename T>
 void copy_back_(MixedTyped* dst, const std::vector<RequestArgument>& ra, char* src) {
     MixedTyped& test = *dst;
-    for_each(test, [&ra, src](int index, std::vector<ty>& m) {
-        ASSERT_EQ(m.size(), ra[index].location.length / sizeof(ty));
+    for_each<T>(test, [&ra, src](int index, std::vector<T>& m) {
+        ASSERT_EQ(m.size(), ra[index].location.length / sizeof(T));
         char* begin = src + ra[index].location.offset;
         memcpy(m.data(), begin, ra[index].location.length);
     });
@@ -213,10 +213,8 @@
         copy_back(&test, outputs_info, outputPtr);
         outputMemory->commit();
         // Filter out don't cares
-        MixedTyped filtered_golden;
-        MixedTyped filtered_test;
-        filter(golden, &filtered_golden, is_ignored);
-        filter(test, &filtered_test, is_ignored);
+        MixedTyped filtered_golden = filter(golden, is_ignored);
+        MixedTyped filtered_test = filter(test, is_ignored);
 
         // We want "close-enough" results for float
         compare(filtered_golden, filtered_test);
diff --git a/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp b/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp
index 98b4994..9c47db6 100644
--- a/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp
+++ b/sensors/1.0/vts/functional/VtsHalSensorsV1_0TargetTest.cpp
@@ -1224,7 +1224,7 @@
 void SensorsHidlTest::testDirectReportOperation(
     SensorType type, SharedMemType memType, RateLevel rate, const SensorEventsChecker &checker) {
   constexpr size_t kEventSize = static_cast<size_t>(SensorsEventFormatOffset::TOTAL_LENGTH);
-  constexpr size_t kNEvent = 500;
+  constexpr size_t kNEvent = 4096;
   constexpr size_t kMemSize = kEventSize * kNEvent;
 
   constexpr float kNormalNominal = 50;
diff --git a/tetheroffload/control/1.0/vts/functional/VtsHalTetheroffloadControlV1_0TargetTest.cpp b/tetheroffload/control/1.0/vts/functional/VtsHalTetheroffloadControlV1_0TargetTest.cpp
index 52dd026..c009af5 100644
--- a/tetheroffload/control/1.0/vts/functional/VtsHalTetheroffloadControlV1_0TargetTest.cpp
+++ b/tetheroffload/control/1.0/vts/functional/VtsHalTetheroffloadControlV1_0TargetTest.cpp
@@ -231,7 +231,6 @@
     initOffload(false);
     initOffload(false);
     initOffload(false);
-    stopOffload(ExpectBoolean::True);  // balance out initOffload(true)
 }
 
 // Check that calling stopOffload() without first having called initOffload() returns false.
@@ -244,6 +243,14 @@
 // Check that calling stopOffload() after a complete init/stop cycle returns false.
 TEST_F(OffloadControlHidlTestBase, AdditionalStopsWithInitReturnFalse) {
     initOffload(true);
+    // Call setUpstreamParameters() so that "offload" can be reasonably said
+    // to be both requested and operational.
+    const hidl_string v4Addr("192.0.0.2");
+    const hidl_string v4Gw("192.0.0.1");
+    const vector<hidl_string> v6Gws{hidl_string("fe80::db8:1"), hidl_string("fe80::db8:2")};
+    const Return<void> upstream =
+        control->setUpstreamParameters("rmnet_data0", v4Addr, v4Gw, v6Gws, ASSERT_TRUE_CALLBACK);
+    EXPECT_TRUE(upstream.isOk());
     stopOffload(ExpectBoolean::True);  // balance out initOffload(true)
     stopOffload(ExpectBoolean::False);
     stopOffload(ExpectBoolean::False);