diff --git a/audio/effect/all-versions/default/Effect.cpp b/audio/effect/all-versions/default/Effect.cpp
index 87e1ab7..5aecd32 100644
--- a/audio/effect/all-versions/default/Effect.cpp
+++ b/audio/effect/all-versions/default/Effect.cpp
@@ -240,16 +240,6 @@
 };
 
 bool ProcessThread::threadLoop() {
-    // For a spatializer effect, we perform scheduler adjustments to reduce glitches and power.
-    {
-        effect_descriptor_t halDescriptor{};
-        if ((*mEffect)->get_descriptor(mEffect, &halDescriptor) == NO_ERROR &&
-            memcmp(&halDescriptor.type, FX_IID_SPATIALIZER, sizeof(effect_uuid_t)) == 0) {
-            const status_t status = scheduler::updateSpatializerPriority(gettid());
-            ALOGW_IF(status != OK, "Failed to update Spatializer priority");
-        }
-    }
-
     // This implementation doesn't return control back to the Thread until it decides to stop,
     // as the Thread uses mutexes, and this can lead to priority inversion.
     while (!std::atomic_load_explicit(mStop, std::memory_order_acquire)) {
@@ -570,6 +560,15 @@
         return Void();
     }
 
+    // For a spatializer effect, we perform scheduler adjustments to reduce glitches and power.
+    // We do it here instead of the ProcessThread::threadLoop to ensure that mHandle is valid.
+    if (effect_descriptor_t halDescriptor{};
+        (*mHandle)->get_descriptor(mHandle, &halDescriptor) == NO_ERROR &&
+        memcmp(&halDescriptor.type, FX_IID_SPATIALIZER, sizeof(effect_uuid_t)) == 0) {
+        const status_t status = scheduler::updateSpatializerPriority(mProcessThread->getTid());
+        ALOGW_IF(status != OK, "Failed to update Spatializer priority");
+    }
+
     mStatusMQ = std::move(tempStatusMQ);
     _hidl_cb(Result::OK, *mStatusMQ->getDesc());
     return Void();
diff --git a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
index 02f6212..f1d61f8 100644
--- a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
+++ b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
@@ -73,9 +73,7 @@
     }
 
     bool executeSetLayerPerFrameMetadataBlobs(uint16_t length) {
-        // must have at least one metadata blob
-        // of at least size 1 in queue (i.e {/*numBlobs=*/1, key, size, blob})
-        if (length < 4) {
+        if (length == 0) {
             return false;
         }
 
diff --git a/scripts/anapic_hidl2aidl_review.sh b/scripts/anapic_hidl2aidl_review.sh
new file mode 100755
index 0000000..330ae32
--- /dev/null
+++ b/scripts/anapic_hidl2aidl_review.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+if [[ $# -ne 1 ]]; then
+    echo "Usage: $0 INTERFACE_NAME"
+    echo "- INTERFACE_NAME fully qualified HIDL interface name with version"
+    echo "example of creating the diffs for android.hardware.boot@1.2"
+    echo "$ ./anapic_hidl2aidl_review.sh android.hardware.boot@1.2"
+    exit 1
+fi
+
+# for pathmod
+source ${ANDROID_BUILD_TOP}/build/make/envsetup.sh
+
+set -ex
+type hidl2aidl 2>/dev/null || m hidl2aidl
+
+INTERFACE_NAME_NO_VER=${1%@*}
+pushd $(pathmod $INTERFACE_NAME_NO_VER)
+rm -rf android
+hidl2aidl -o . "$1"
+rm -rf conversion.log translate include
+git add -A
+git commit -am "convert $1" --no-edit
+git revert HEAD --no-edit
+git commit --amend --no-edit
+repo upload . --no-verify
+popd
diff --git a/security/keymint/support/Android.bp b/security/keymint/support/Android.bp
index efd6fc7..8d7731c 100644
--- a/security/keymint/support/Android.bp
+++ b/security/keymint/support/Android.bp
@@ -84,6 +84,7 @@
         "android.hardware.security.rkp-V3-ndk",
         "libgmock",
         "libgtest_main",
+        "libkeymint_remote_prov_support",
     ],
     defaults: [
         "keymint_use_latest_hal_aidl_ndk_shared",
@@ -95,6 +96,5 @@
         "libcrypto",
         "libjsoncpp",
         "libkeymaster_portable",
-        "libkeymint_remote_prov_support",
     ],
 }
diff --git a/security/keymint/support/remote_prov_utils.cpp b/security/keymint/support/remote_prov_utils.cpp
index 7e164fd..ea0fbd8 100644
--- a/security/keymint/support/remote_prov_utils.cpp
+++ b/security/keymint/support/remote_prov_utils.cpp
@@ -417,6 +417,7 @@
 
 JsonOutput jsonEncodeCsrWithBuild(const std::string instance_name, const cppbor::Array& csr) {
     const std::string kFingerprintProp = "ro.build.fingerprint";
+    const std::string kSerialNoProp = "ro.serialno";
 
     if (!::android::base::WaitForPropertyCreation(kFingerprintProp)) {
         return JsonOutput::Error("Unable to read build fingerprint");
@@ -441,6 +442,7 @@
     Json::Value json(Json::objectValue);
     json["name"] = instance_name;
     json["build_fingerprint"] = ::android::base::GetProperty(kFingerprintProp, /*default=*/"");
+    json["serialno"] = ::android::base::GetProperty(kSerialNoProp, /*default=*/"");
     json["csr"] = base64.data();  // Boring writes a NUL-terminated c-string
 
     Json::StreamWriterBuilder factory;
diff --git a/security/keymint/support/remote_prov_utils_test.cpp b/security/keymint/support/remote_prov_utils_test.cpp
index 0250cd6..eaaba45 100644
--- a/security/keymint/support/remote_prov_utils_test.cpp
+++ b/security/keymint/support/remote_prov_utils_test.cpp
@@ -191,7 +191,8 @@
 
     std::string expected = R"({"build_fingerprint":")" +
                            ::android::base::GetProperty("ro.build.fingerprint", /*default=*/"") +
-                           R"(","csr":"gQE=","name":"test"})";
+                           R"(","csr":"gQE=","name":"test","serialno":")" +
+                           ::android::base::GetProperty("ro.serialno", /*default=*/"") + R"("})";
 
     ASSERT_EQ(json, expected);
 }