diff --git a/debuggerd/TEST_MAPPING b/debuggerd/TEST_MAPPING
index 8633cb8..61d7155 100644
--- a/debuggerd/TEST_MAPPING
+++ b/debuggerd/TEST_MAPPING
@@ -14,5 +14,10 @@
     {
       "name": "debuggerd_test"
     }
+  ],
+  "postsubmit": [
+    {
+      "name": "CtsCrashDetailHostTestCases"
+    }
   ]
 }
diff --git a/debuggerd/tombstoned/tombstoned.cpp b/debuggerd/tombstoned/tombstoned.cpp
index 98eb003..e2a67a2 100644
--- a/debuggerd/tombstoned/tombstoned.cpp
+++ b/debuggerd/tombstoned/tombstoned.cpp
@@ -61,7 +61,6 @@
 
 struct CrashArtifact {
   unique_fd fd;
-  std::optional<std::string> temporary_path;
 
   static CrashArtifact devnull() {
     CrashArtifact result;
@@ -145,17 +144,9 @@
     std::optional<std::string> path;
     result.fd.reset(openat(dir_fd_, ".", O_WRONLY | O_APPEND | O_TMPFILE | O_CLOEXEC, 0660));
     if (result.fd == -1) {
-      // We might not have O_TMPFILE. Try creating with an arbitrary filename instead.
-      static size_t counter = 0;
-      std::string tmp_filename = StringPrintf(".temporary%zu", counter++);
-      result.fd.reset(openat(dir_fd_, tmp_filename.c_str(),
-                             O_WRONLY | O_APPEND | O_CREAT | O_TRUNC | O_CLOEXEC, 0660));
-      if (result.fd == -1) {
-        PLOG(FATAL) << "failed to create temporary tombstone in " << dir_path_;
-      }
-
-      result.temporary_path = std::move(tmp_filename);
+      PLOG(FATAL) << "failed to create temporary tombstone in " << dir_path_;
     }
+
     // We need to fchmodat after creating to avoid getting the umask applied.
     std::string fd_path = StringPrintf("/proc/self/fd/%d", result.fd.get());
     if (fchmodat(dir_fd_, fd_path.c_str(), 0664, 0) != 0) {
@@ -477,20 +468,6 @@
       rename_tombstone_fd(crash->output.proto->fd, queue->dir_fd(), *paths.proto);
     }
   }
-
-  // If we don't have O_TMPFILE, we need to clean up after ourselves.
-  if (crash->output.text.temporary_path) {
-    rc = unlinkat(queue->dir_fd().get(), crash->output.text.temporary_path->c_str(), 0);
-    if (rc != 0) {
-      PLOG(ERROR) << "failed to unlink temporary tombstone at " << paths.text;
-    }
-  }
-  if (crash->output.proto && crash->output.proto->temporary_path) {
-    rc = unlinkat(queue->dir_fd().get(), crash->output.proto->temporary_path->c_str(), 0);
-    if (rc != 0) {
-      PLOG(ERROR) << "failed to unlink temporary proto tombstone";
-    }
-  }
 }
 
 static void crash_completed_cb(evutil_socket_t sockfd, short ev, void* arg) {
diff --git a/fs_mgr/libdm/dm_target.cpp b/fs_mgr/libdm/dm_target.cpp
index 90d91a0..1f6bd1a 100644
--- a/fs_mgr/libdm/dm_target.cpp
+++ b/fs_mgr/libdm/dm_target.cpp
@@ -61,6 +61,10 @@
     return block_device_ + " " + std::to_string(physical_sector_);
 }
 
+std::string DmTargetStripe::GetParameterString() const {
+    return "2 " + std::to_string(chunksize) + " " + block_device0_ + " 0 " + block_device1_ + " 0";
+}
+
 DmTargetVerity::DmTargetVerity(uint64_t start, uint64_t length, uint32_t version,
                                const std::string& block_device, const std::string& hash_device,
                                uint32_t data_block_size, uint32_t hash_block_size,
diff --git a/fs_mgr/libdm/dm_test.cpp b/fs_mgr/libdm/dm_test.cpp
index a0129c2..d043be6 100644
--- a/fs_mgr/libdm/dm_test.cpp
+++ b/fs_mgr/libdm/dm_test.cpp
@@ -181,6 +181,13 @@
     ASSERT_EQ(dm.GetState(dev.name()), DmDeviceState::ACTIVE);
 }
 
+TEST_F(DmTest, StripeArgs) {
+    DmTargetStripe target(0, 4096, 1024, "/dev/loop0", "/dev/loop1");
+    ASSERT_EQ(target.name(), "striped");
+    ASSERT_TRUE(target.Valid());
+    ASSERT_EQ(target.GetParameterString(), "2 1024 /dev/loop0 0 /dev/loop1 0");
+}
+
 TEST_F(DmTest, DmVerityArgsAvb2) {
     std::string device = "/dev/block/platform/soc/1da4000.ufshc/by-name/vendor_a";
     std::string algorithm = "sha1";
diff --git a/fs_mgr/libdm/include/libdm/dm_target.h b/fs_mgr/libdm/include/libdm/dm_target.h
index 09fe200..97f3c13 100644
--- a/fs_mgr/libdm/include/libdm/dm_target.h
+++ b/fs_mgr/libdm/include/libdm/dm_target.h
@@ -116,6 +116,24 @@
     uint64_t physical_sector_;
 };
 
+class DmTargetStripe final : public DmTarget {
+  public:
+    DmTargetStripe(uint64_t start, uint64_t length, uint64_t chunksize,
+                   const std::string& block_device0, const std::string& block_device1)
+        : DmTarget(start, length),
+          chunksize(chunksize),
+          block_device0_(block_device0),
+          block_device1_(block_device1) {}
+
+    std::string name() const override { return "striped"; }
+    std::string GetParameterString() const override;
+
+  private:
+    uint64_t chunksize;
+    std::string block_device0_;
+    std::string block_device1_;
+};
+
 class DmTargetVerity final : public DmTarget {
   public:
     DmTargetVerity(uint64_t start, uint64_t length, uint32_t version,
diff --git a/fs_mgr/libsnapshot/snapshotctl.cpp b/fs_mgr/libsnapshot/snapshotctl.cpp
index 0396a55..50e9f48 100644
--- a/fs_mgr/libsnapshot/snapshotctl.cpp
+++ b/fs_mgr/libsnapshot/snapshotctl.cpp
@@ -15,6 +15,7 @@
 //
 
 #include <sysexits.h>
+#include <unistd.h>
 
 #include <chrono>
 #include <filesystem>
@@ -46,9 +47,7 @@
 
 #include "partition_cow_creator.h"
 
-#ifdef SNAPSHOTCTL_USERDEBUG_OR_ENG
 #include <BootControlClient.h>
-#endif
 
 using namespace std::chrono_literals;
 using namespace std::string_literals;
@@ -79,7 +78,11 @@
                  "  revert-snapshots\n"
                  "    Prepares devices to boot without snapshots on next boot.\n"
                  "    This does not delete the snapshot. It only removes the indicators\n"
-                 "    so that first stage init will not mount from snapshots.\n";
+                 "    so that first stage init will not mount from snapshots.\n"
+                 "  apply-update\n"
+                 "    Apply the incremental OTA update wherein the snapshots are\n"
+                 "    directly written to COW block device. This will bypass update-engine\n"
+                 "    and the device will be ready to boot from the target build.\n";
     return EX_USAGE;
 }
 
@@ -96,14 +99,22 @@
     bool DeleteSnapshots();
     bool CleanupSnapshot() { return sm_->PrepareDeviceToBootWithoutSnapshot(); }
     bool BeginUpdate();
+    bool ApplyUpdate();
 
   private:
     std::optional<std::string> GetCowImagePath(std::string& name);
+    bool PrepareUpdate();
     bool WriteSnapshotPatch(std::string cow_device, std::string patch);
+    std::string GetGroupName(const android::fs_mgr::LpMetadata& pt,
+                             const std::string& partiton_name);
     std::unique_ptr<SnapshotManager::LockedFile> lock_;
     std::unique_ptr<SnapshotManager> sm_;
     std::vector<std::future<bool>> threads_;
     std::string snapshot_dir_path_;
+    std::unordered_map<std::string, chromeos_update_engine::DynamicPartitionGroup*> group_map_;
+
+    std::vector<std::string> patchfiles_;
+    chromeos_update_engine::DeltaArchiveManifest manifest_;
 };
 
 MapSnapshots::MapSnapshots(std::string path) {
@@ -115,6 +126,178 @@
     snapshot_dir_path_ = path + "/";
 }
 
+std::string MapSnapshots::GetGroupName(const android::fs_mgr::LpMetadata& pt,
+                                       const std::string& partition_name) {
+    std::string group_name;
+    for (const auto& partition : pt.partitions) {
+        std::string name = android::fs_mgr::GetPartitionName(partition);
+        auto suffix = android::fs_mgr::GetPartitionSlotSuffix(name);
+        std::string pname = name.substr(0, name.size() - suffix.size());
+        if (pname == partition_name) {
+            std::string group_name =
+                    android::fs_mgr::GetPartitionGroupName(pt.groups[partition.group_index]);
+            return group_name.substr(0, group_name.size() - suffix.size());
+        }
+    }
+    return "";
+}
+
+bool MapSnapshots::PrepareUpdate() {
+    auto source_slot = fs_mgr_get_slot_suffix();
+    auto source_slot_number = SlotNumberForSlotSuffix(source_slot);
+    auto super_source = fs_mgr_get_super_partition_name(source_slot_number);
+
+    // Get current partition information.
+    PartitionOpener opener;
+    auto source_metadata = ReadMetadata(opener, super_source, source_slot_number);
+    if (!source_metadata) {
+        LOG(ERROR) << "Could not read source partition metadata.\n";
+        return false;
+    }
+
+    auto dap = manifest_.mutable_dynamic_partition_metadata();
+    dap->set_snapshot_enabled(true);
+    dap->set_vabc_enabled(true);
+    dap->set_vabc_compression_param("lz4");
+    dap->set_cow_version(3);
+
+    for (const auto& entry : std::filesystem::directory_iterator(snapshot_dir_path_)) {
+        if (android::base::EndsWith(entry.path().generic_string(), ".patch")) {
+            patchfiles_.push_back(android::base::Basename(entry.path().generic_string()));
+        }
+    }
+
+    for (auto& patchfile : patchfiles_) {
+        std::string parsing_file = snapshot_dir_path_ + patchfile;
+        android::base::unique_fd fd(TEMP_FAILURE_RETRY(open(parsing_file.c_str(), O_RDONLY)));
+        if (fd < 0) {
+            LOG(ERROR) << "Failed to open file: " << parsing_file;
+            return false;
+        }
+        uint64_t dev_sz = lseek(fd.get(), 0, SEEK_END);
+        if (!dev_sz) {
+            LOG(ERROR) << "Could not determine block device size: " << parsing_file;
+            return false;
+        }
+
+        const int block_sz = 4_KiB;
+        dev_sz += block_sz - 1;
+        dev_sz &= ~(block_sz - 1);
+
+        auto npos = patchfile.rfind(".patch");
+        auto partition_name = patchfile.substr(0, npos);
+
+        chromeos_update_engine::DynamicPartitionGroup* group = nullptr;
+        std::string group_name = GetGroupName(*source_metadata.get(), partition_name);
+        if (group_map_.find(group_name) != group_map_.end()) {
+            group = group_map_[group_name];
+        } else {
+            group = dap->add_groups();
+            group->set_name(group_name);
+            group_map_[group_name] = group;
+        }
+        group->add_partition_names(partition_name);
+
+        auto pu = manifest_.mutable_partitions()->Add();
+        pu->set_partition_name(partition_name);
+        pu->set_estimate_cow_size(dev_sz);
+
+        CowReader reader;
+        if (!reader.Parse(fd)) {
+            LOG(ERROR) << "COW reader parse failed";
+            return false;
+        }
+
+        uint64_t new_device_size = 0;
+        const auto& header = reader.GetHeader();
+        if (header.prefix.major_version == 2) {
+            size_t num_ops = reader.get_num_total_data_ops();
+            new_device_size = (num_ops * header.block_size);
+        } else {
+            const auto& v3_header = reader.header_v3();
+            new_device_size = v3_header.op_count_max * v3_header.block_size;
+        }
+
+        LOG(INFO) << "Partition: " << partition_name << " Group_name: " << group_name
+                  << " size: " << new_device_size << " COW-size: " << dev_sz;
+        pu->mutable_new_partition_info()->set_size(new_device_size);
+    }
+    return true;
+}
+
+bool MapSnapshots::ApplyUpdate() {
+    if (!PrepareUpdate()) {
+        LOG(ERROR) << "PrepareUpdate failed";
+        return false;
+    }
+    if (!sm_->BeginUpdate()) {
+        LOG(ERROR) << "BeginUpdate failed";
+        return false;
+    }
+    if (!sm_->CreateUpdateSnapshots(manifest_)) {
+        LOG(ERROR) << "Could not apply snapshots";
+        return false;
+    }
+
+    LOG(INFO) << "CreateUpdateSnapshots success";
+    if (!sm_->MapAllSnapshots(10s)) {
+        LOG(ERROR) << "MapAllSnapshots failed";
+        return false;
+    }
+
+    LOG(INFO) << "MapAllSnapshots success";
+
+    auto& dm = android::dm::DeviceMapper::Instance();
+    auto target_slot = fs_mgr_get_other_slot_suffix();
+    for (auto& patchfile : patchfiles_) {
+        auto npos = patchfile.rfind(".patch");
+        auto partition_name = patchfile.substr(0, npos) + target_slot;
+        auto cow_device = partition_name + "-cow";
+        std::string cow_path;
+        if (!dm.GetDmDevicePathByName(cow_device, &cow_path)) {
+            LOG(ERROR) << "Failed to cow path";
+            return false;
+        }
+        threads_.emplace_back(std::async(std::launch::async, &MapSnapshots::WriteSnapshotPatch,
+                                         this, cow_path, patchfile));
+    }
+
+    bool ret = true;
+    for (auto& t : threads_) {
+        ret = t.get() && ret;
+    }
+    if (!ret) {
+        LOG(ERROR) << "Snapshot writes failed";
+        return false;
+    }
+    if (!sm_->UnmapAllSnapshots()) {
+        LOG(ERROR) << "UnmapAllSnapshots failed";
+        return false;
+    }
+
+    LOG(INFO) << "Pre-created snapshots successfully copied";
+    // All snapshots have been written.
+    if (!sm_->FinishedSnapshotWrites(false /* wipe */)) {
+        LOG(ERROR) << "Could not finalize snapshot writes.\n";
+        return false;
+    }
+
+    auto hal = hal::BootControlClient::WaitForService();
+    if (!hal) {
+        LOG(ERROR) << "Could not find IBootControl HAL.\n";
+        return false;
+    }
+    auto target_slot_number = SlotNumberForSlotSuffix(target_slot);
+    auto cr = hal->SetActiveBootSlot(target_slot_number);
+    if (!cr.IsOk()) {
+        LOG(ERROR) << "Could not set active boot slot: " << cr.errMsg;
+        return false;
+    }
+
+    LOG(INFO) << "ApplyUpdate success";
+    return true;
+}
+
 bool MapSnapshots::BeginUpdate() {
     lock_ = sm_->LockExclusive();
     std::vector<std::string> snapshots;
@@ -227,11 +410,10 @@
         if (file_offset >= dev_sz) {
             break;
         }
-
-        if (fsync(cfd.get()) < 0) {
-            PLOG(ERROR) << "Fsync failed at offset: " << file_offset << " size: " << to_read;
-            return false;
-        }
+    }
+    if (fsync(cfd.get()) < 0) {
+        PLOG(ERROR) << "Fsync failed";
+        return false;
     }
     return true;
 }
@@ -367,6 +549,30 @@
     return snapshot.DeleteSnapshots();
 }
 
+bool ApplyUpdate(int argc, char** argv) {
+    android::base::InitLogging(argv, &android::base::KernelLogger);
+
+    // Make sure we are root.
+    if (::getuid() != 0) {
+        LOG(ERROR) << "Not running as root. Try \"adb root\" first.";
+        return EXIT_FAILURE;
+    }
+
+    if (argc < 3) {
+        std::cerr << " apply-update <directory location where snapshot patches are present>"
+                     "    Apply the snapshots to the COW block device\n";
+        return false;
+    }
+
+    std::string path = std::string(argv[2]);
+    MapSnapshots cow(path);
+    if (!cow.ApplyUpdate()) {
+        return false;
+    }
+    LOG(INFO) << "Apply update success. Please reboot the device";
+    return true;
+}
+
 bool MapPrecreatedSnapshots(int argc, char** argv) {
     android::base::InitLogging(argv, &android::base::KernelLogger);
 
@@ -554,6 +760,7 @@
         {"test-blank-ota", TestOtaHandler},
 #endif
         {"unmap", UnmapCmdHandler},
+        {"apply-update", ApplyUpdate},
         {"map-snapshots", MapPrecreatedSnapshots},
         {"unmap-snapshots", UnMapPrecreatedSnapshots},
         {"delete-snapshots", DeletePrecreatedSnapshots},
diff --git a/fs_mgr/tools/dmctl.cpp b/fs_mgr/tools/dmctl.cpp
index 7273087..9dc8c24 100644
--- a/fs_mgr/tools/dmctl.cpp
+++ b/fs_mgr/tools/dmctl.cpp
@@ -115,6 +115,21 @@
             std::string block_device = NextArg();
             return std::make_unique<DmTargetAndroidVerity>(start_sector, num_sectors, keyid,
                                                            block_device);
+        } else if (target_type == "striped") {
+            if (!HasArgs(3)) {
+                std::cerr << "Expected \"striped\" <block_device0> <block_device1> <chunksize>"
+                          << std::endl;
+                return nullptr;
+            }
+            std::string block_device0 = NextArg();
+            std::string block_device1 = NextArg();
+            uint64_t chunk_size;
+            if (!android::base::ParseUint(NextArg(), &chunk_size)) {
+                std::cerr << "Expected start sector, got: " << PreviousArg() << std::endl;
+                return nullptr;
+            }
+            return std::make_unique<DmTargetStripe>(start_sector, num_sectors, chunk_size,
+                                                    block_device0, block_device1);
         } else if (target_type == "bow") {
             if (!HasArgs(1)) {
                 std::cerr << "Expected \"bow\" <block_device>" << std::endl;
diff --git a/libvendorsupport/Android.bp b/libvendorsupport/Android.bp
index b4457b1..e87959e 100644
--- a/libvendorsupport/Android.bp
+++ b/libvendorsupport/Android.bp
@@ -34,3 +34,32 @@
         "liblog",
     ],
 }
+
+cc_library_headers {
+    name: "libvendorsupport_llndk_headers",
+    host_supported: true,
+    vendor_available: true,
+    recovery_available: true,
+    ramdisk_available: true,
+    vendor_ramdisk_available: true,
+    native_bridge_supported: true,
+
+    export_include_dirs: ["include_llndk"],
+    llndk: {
+        llndk_headers: true,
+    },
+
+    apex_available: [
+        "//apex_available:platform",
+        "//apex_available:anyapex",
+    ],
+    min_sdk_version: "apex_inherit",
+
+    system_shared_libs: [],
+    stl: "none",
+
+    // This header library is used for libc and must be available to any sdk
+    // versions.
+    // Setting sdk_version to the lowest version allows the dependencies.
+    sdk_version: "1",
+}
diff --git a/libvendorsupport/include_llndk/android/llndk-versioning.h b/libvendorsupport/include_llndk/android/llndk-versioning.h
new file mode 100644
index 0000000..7c408c9
--- /dev/null
+++ b/libvendorsupport/include_llndk/android/llndk-versioning.h
@@ -0,0 +1,48 @@
+// Copyright (C) 2024 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include <sys/cdefs.h>
+
+__BEGIN_DECLS
+
+#if defined(__ANDROID_VENDOR__)
+
+// LLNDK (https://source.android.com/docs/core/architecture/vndk/build-system#ll-ndk) is similar to
+// NDK, but uses its own versioning of YYYYMM format for vendor builds. The LLNDK symbols are
+// enabled when the vendor api level is equal to or newer than the ro.board.api_level.
+#define __INTRODUCED_IN_LLNDK(vendor_api_level)                                             \
+    _Pragma("clang diagnostic push") _Pragma("clang diagnostic ignored \"-Wgcc-compat\"")   \
+            __attribute__((enable_if(                                                       \
+                    __ANDROID_VENDOR_API__ >= vendor_api_level,                             \
+                    "available in vendor API level " #vendor_api_level " that "             \
+                    "is newer than the current vendor API level. Guard the API "            \
+                    "call with '#if (__ANDROID_VENDOR_API__ >= " #vendor_api_level ")'."))) \
+            _Pragma("clang diagnostic pop")
+
+// For the vendor libraries, __INTRODUCED_IN must be ignored because they are only for NDKs but not
+// for LLNDKs.
+#undef __INTRODUCED_IN
+#define __INTRODUCED_IN(x)
+
+#else  // __ANDROID_VENDOR__
+
+// For non-vendor libraries, __INTRODUCED_IN_LLNDK must be ignored because it must not change
+// symbols of NDK or the system side of the treble boundary.
+#define __INTRODUCED_IN_LLNDK(vendor_api_level)
+
+#endif  // __ANDROID_VENDOR__
+
+__END_DECLS
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 3c367f9..8a2ed9f 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -641,9 +641,9 @@
 
     mkdir /metadata/staged-install 0770 root system
 
-    mkdir /metadata/aconfig 0750 root system
-    mkdir /metadata/aconfig/flags 0750 root system
-    mkdir /metadata/aconfig/boot 0754 root system
+    mkdir /metadata/aconfig 0775 root system
+    mkdir /metadata/aconfig/flags 0770 root system
+    mkdir /metadata/aconfig/boot 0775 root system
 
 on late-fs
     # Ensure that tracefs has the correct permissions.