diff --git a/src/com/android/phone/PhoneInterfaceManager.java b/src/com/android/phone/PhoneInterfaceManager.java
index 7b16888..0b4e9f1 100755
--- a/src/com/android/phone/PhoneInterfaceManager.java
+++ b/src/com/android/phone/PhoneInterfaceManager.java
@@ -1257,7 +1257,7 @@
     @Override
     public boolean isOffhookForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "isOffhookForSubscriber")) {
+                mApp, subId, callingPackage, "isOffhookForSubscriber")) {
             return false;
         }
 
@@ -1277,7 +1277,7 @@
     @Override
     public boolean isRingingForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "isRingingForSubscriber")) {
+                mApp, subId, callingPackage, "isRingingForSubscriber")) {
             return false;
         }
 
@@ -1297,7 +1297,7 @@
     @Override
     public boolean isIdleForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "isIdleForSubscriber")) {
+                mApp, subId, callingPackage, "isIdleForSubscriber")) {
             return false;
         }
 
@@ -1473,7 +1473,7 @@
     @Override
     public boolean isRadioOnForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "isRadioOnForSubscriber")) {
+                mApp, subId, callingPackage, "isRadioOnForSubscriber")) {
             return false;
         }
         return isRadioOnForSubscriber(subId);
@@ -1786,32 +1786,44 @@
 
     @Override
     public String getImeiForSlot(int slotIndex, String callingPackage) {
-        if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getImeiForSlot")) {
+        Phone phone = PhoneFactory.getPhone(slotIndex);
+        if (phone == null) {
             return null;
         }
-        Phone phone = PhoneFactory.getPhone(slotIndex);
-        return phone == null ? null : phone.getImei();
+        int subId = phone.getSubId();
+        if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
+                mApp, subId, callingPackage, "getImeiForSlot")) {
+            return null;
+        }
+        return phone.getImei();
     }
 
     @Override
     public String getMeidForSlot(int slotIndex, String callingPackage) {
-        if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getMeidForSlot")) {
+        Phone phone = PhoneFactory.getPhone(slotIndex);
+        if (phone == null) {
             return null;
         }
-        Phone phone = PhoneFactory.getPhone(slotIndex);
-        return phone == null ? null : phone.getMeid();
+        int subId = phone.getSubId();
+        if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
+                mApp, subId, callingPackage, "getMeidForSlot")) {
+            return null;
+        }
+        return phone.getMeid();
     }
 
     @Override
     public String getDeviceSoftwareVersionForSlot(int slotIndex, String callingPackage) {
-        if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getDeviceSoftwareVersionForSlot")) {
+        Phone phone = PhoneFactory.getPhone(slotIndex);
+        if (phone == null) {
             return null;
         }
-        Phone phone = PhoneFactory.getPhone(slotIndex);
-        return phone == null ? null : phone.getDeviceSvn();
+        int subId = phone.getSubId();
+        if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
+                mApp, subId, callingPackage, "getDeviceSoftwareVersionForSlot")) {
+            return null;
+        }
+        return phone.getDeviceSvn();
     }
 
     @Override
@@ -1900,7 +1912,7 @@
     @Override
     public int getCdmaEriIconIndexForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getCdmaEriIconIndexForSubscriber")) {
+                mApp, subId, callingPackage, "getCdmaEriIconIndexForSubscriber")) {
             return -1;
         }
         final Phone phone = getPhone(subId);
@@ -1924,7 +1936,7 @@
     @Override
     public int getCdmaEriIconModeForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getCdmaEriIconModeForSubscriber")) {
+                mApp, subId, callingPackage, "getCdmaEriIconModeForSubscriber")) {
             return -1;
         }
         final Phone phone = getPhone(subId);
@@ -1946,7 +1958,7 @@
     @Override
     public String getCdmaEriTextForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getCdmaEriIconTextForSubscriber")) {
+                mApp, subId, callingPackage, "getCdmaEriIconTextForSubscriber")) {
             return null;
         }
         final Phone phone = getPhone(subId);
@@ -2023,7 +2035,7 @@
     public String getVisualVoicemailPackageName(String callingPackage, int subId) {
         mAppOps.checkPackage(Binder.getCallingUid(), callingPackage);
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getVisualVoicemailPackageName")) {
+                mApp, subId, callingPackage, "getVisualVoicemailPackageName")) {
             return null;
         }
         return RemoteVvmTaskManager.getRemotePackage(mPhone.getContext(), subId).getPackageName();
@@ -2118,7 +2130,7 @@
     @Override
     public int getVoiceActivationState(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getVoiceActivationStateForSubscriber")) {
+                mApp, subId, callingPackage, "getVoiceActivationStateForSubscriber")) {
             return TelephonyManager.SIM_ACTIVATION_STATE_UNKNOWN;
         }
         final Phone phone = getPhone(subId);
@@ -2135,7 +2147,7 @@
     @Override
     public int getDataActivationState(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getDataActivationStateForSubscriber")) {
+                mApp, subId, callingPackage, "getDataActivationStateForSubscriber")) {
             return TelephonyManager.SIM_ACTIVATION_STATE_UNKNOWN;
         }
         final Phone phone = getPhone(subId);
@@ -2214,7 +2226,7 @@
     @Override
     public int getNetworkTypeForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getNetworkTypeForSubscriber")) {
+                mApp, subId, callingPackage, "getNetworkTypeForSubscriber")) {
             return TelephonyManager.NETWORK_TYPE_UNKNOWN;
         }
 
@@ -2240,7 +2252,7 @@
     @Override
     public int getDataNetworkTypeForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getDataNetworkTypeForSubscriber")) {
+                mApp, subId, callingPackage, "getDataNetworkTypeForSubscriber")) {
             return TelephonyManager.NETWORK_TYPE_UNKNOWN;
         }
 
@@ -2258,7 +2270,7 @@
     @Override
     public int getVoiceNetworkTypeForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getDataNetworkTypeForSubscriber")) {
+                mApp, subId, callingPackage, "getDataNetworkTypeForSubscriber")) {
             return TelephonyManager.NETWORK_TYPE_UNKNOWN;
         }
 
@@ -2309,7 +2321,7 @@
     @Override
     public int getLteOnCdmaModeForSubscriber(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getLteOnCdmaModeForSubscriber")) {
+                mApp, subId, callingPackage, "getLteOnCdmaModeForSubscriber")) {
             return PhoneConstants.LTE_ON_CDMA_UNKNOWN;
         }
 
@@ -2508,6 +2520,7 @@
      * on a particular subscription
      */
     public String[] getForbiddenPlmns(int subId, int appType) {
+        // TODO(b/73884967): Migrate to TelephonyPermissions check.
         mApp.enforceCallingOrSelfPermission(android.Manifest.permission.READ_PHONE_STATE,
                 "Requires READ_PHONE_STATE");
         if (appType != TelephonyManager.APPTYPE_USIM && appType != TelephonyManager.APPTYPE_SIM) {
@@ -2621,7 +2634,7 @@
 
     public String[] getPcscfAddress(String apnType, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getPcscfAddress")) {
+                mApp, mPhone.getSubId(), callingPackage, "getPcscfAddress")) {
             return new String[0];
         }
 
@@ -2783,7 +2796,7 @@
     @Override
     public int getCalculatedPreferredNetworkType(String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getCalculatedPreferredNetworkType")) {
+                mApp, mPhone.getSubId(), callingPackage, "getCalculatedPreferredNetworkType")) {
             return RILConstants.PREFERRED_NETWORK_MODE;
         }
 
@@ -3128,7 +3141,7 @@
     public String getLine1NumberForDisplay(int subId, String callingPackage) {
         // This is open to apps with WRITE_SMS.
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneNumber(
-                mApp, callingPackage, "getLine1NumberForDisplay")) {
+                mApp, subId, callingPackage, "getLine1NumberForDisplay")) {
             if (DBG_MERGE) log("getLine1NumberForDisplay returning null due to permission");
             return null;
         }
@@ -3149,7 +3162,7 @@
     @Override
     public String getLine1AlphaTagForDisplay(int subId, String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getLine1AlphaTagForDisplay")) {
+                mApp, subId, callingPackage, "getLine1AlphaTagForDisplay")) {
             return null;
         }
 
@@ -3163,8 +3176,11 @@
 
     @Override
     public String[] getMergedSubscriberIds(String callingPackage) {
+        // This API isn't public, so no need to provide a valid subscription ID - we're not worried
+        // about carrier-privileged callers not having access.
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getMergedSubscriberIds")) {
+                mApp, SubscriptionManager.INVALID_SUBSCRIPTION_ID, callingPackage,
+                "getMergedSubscriberIds")) {
             return null;
         }
         final Context context = mPhone.getContext();
@@ -3267,8 +3283,13 @@
 
     @Override
     public int getRadioAccessFamily(int phoneId, String callingPackage) {
+        Phone phone = PhoneFactory.getPhone(phoneId);
+        if (phone == null) {
+            return RadioAccessFamily.RAF_UNKNOWN;
+        }
+        int subId = phone.getSubId();
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getRadioAccessFamily")) {
+                mApp, subId, callingPackage, "getRadioAccessFamily")) {
             return RadioAccessFamily.RAF_UNKNOWN;
         }
 
@@ -3284,7 +3305,7 @@
     @Override
     public boolean isVideoCallingEnabled(String callingPackage) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "isVideoCallingEnabled")) {
+                mApp, mPhone.getSubId(), callingPackage, "isVideoCallingEnabled")) {
             return false;
         }
 
@@ -3338,17 +3359,16 @@
      */
     @Override
     public String getDeviceId(String callingPackage) {
-        if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getDeviceId")) {
-            return null;
-        }
-
         final Phone phone = PhoneFactory.getPhone(0);
-        if (phone != null) {
-            return phone.getDeviceId();
-        } else {
+        if (phone == null) {
             return null;
         }
+        int subId = phone.getSubId();
+        if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
+                mApp, subId, callingPackage, "getDeviceId")) {
+            return null;
+        }
+        return phone.getDeviceId();
     }
 
     /**
@@ -3557,7 +3577,7 @@
     public ServiceState getServiceStateForSubscriber(int subId, String callingPackage) {
 
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getServiceStateForSubscriber")) {
+                mApp, subId, callingPackage, "getServiceStateForSubscriber")) {
             return null;
         }
 
@@ -3943,7 +3963,7 @@
     @Override
     public List<ClientRequestStats> getClientRequestStats(String callingPackage, int subId) {
         if (!TelephonyPermissions.checkCallingOrSelfReadPhoneState(
-                mApp, callingPackage, "getClientRequestStats")) {
+                mApp, subId, callingPackage, "getClientRequestStats")) {
             return null;
         }
 
diff --git a/src/com/android/phone/vvm/RemoteVvmTaskManager.java b/src/com/android/phone/vvm/RemoteVvmTaskManager.java
index 4fc8c57..cf5011e 100644
--- a/src/com/android/phone/vvm/RemoteVvmTaskManager.java
+++ b/src/com/android/phone/vvm/RemoteVvmTaskManager.java
@@ -119,6 +119,8 @@
         TelecomManager telecomManager = context.getSystemService(TelecomManager.class);
         List<String> packages = new ArrayList<>();
         packages.add(telecomManager.getDefaultDialerPackage());
+        // TODO(b/73136824): Check permissions in the calling function and avoid relying on the
+        // binder caller's permissions to access the carrier config.
         PersistableBundle carrierConfig = context
                 .getSystemService(CarrierConfigManager.class).getConfigForSubId(subId);
         packages.add(