diff --git a/fastboot/constants.h b/fastboot/constants.h
index ad169d1..a803307 100644
--- a/fastboot/constants.h
+++ b/fastboot/constants.h
@@ -69,6 +69,7 @@
 #define FB_VAR_VARIANT "variant"
 #define FB_VAR_OFF_MODE_CHARGE_STATE "off-mode-charge"
 #define FB_VAR_BATTERY_VOLTAGE "battery-voltage"
+#define FB_VAR_BATTERY_SOC "battery-soc"
 #define FB_VAR_BATTERY_SOC_OK "battery-soc-ok"
 #define FB_VAR_SUPER_PARTITION_NAME "super-partition-name"
 #define FB_VAR_SNAPSHOT_UPDATE_STATUS "snapshot-update-status"
diff --git a/fastboot/device/commands.cpp b/fastboot/device/commands.cpp
index 6de598f..bd936ae 100644
--- a/fastboot/device/commands.cpp
+++ b/fastboot/device/commands.cpp
@@ -134,6 +134,7 @@
         {FB_VAR_IS_FORCE_DEBUGGABLE, {GetIsForceDebuggable, nullptr}},
         {FB_VAR_OFF_MODE_CHARGE_STATE, {GetOffModeChargeState, nullptr}},
         {FB_VAR_BATTERY_VOLTAGE, {GetBatteryVoltage, nullptr}},
+        {FB_VAR_BATTERY_SOC, {GetBatterySoC, nullptr}},
         {FB_VAR_BATTERY_SOC_OK, {GetBatterySoCOk, nullptr}},
         {FB_VAR_HW_REVISION, {GetHardwareRevision, nullptr}},
         {FB_VAR_SUPER_PARTITION_NAME, {GetSuperPartitionName, nullptr}},
diff --git a/fastboot/device/variables.cpp b/fastboot/device/variables.cpp
index d2a7947..2847e35 100644
--- a/fastboot/device/variables.cpp
+++ b/fastboot/device/variables.cpp
@@ -130,6 +130,21 @@
     return true;
 }
 
+bool GetBatterySoCHelper(FastbootDevice* device, int32_t* battery_soc) {
+    using aidl::android::hardware::health::HealthInfo;
+
+    auto health_hal = device->health_hal();
+    if (!health_hal) {
+        return false;
+    }
+
+    HealthInfo health_info;
+    auto res = health_hal->getHealthInfo(&health_info);
+    if (!res.isOk()) return false;
+    *battery_soc = health_info.batteryLevel;
+    return true;
+}
+
 bool GetBatterySoCOk(FastbootDevice* device, const std::vector<std::string>& /* args */,
                      std::string* message) {
     int32_t battery_voltage = 0;
@@ -185,6 +200,17 @@
     return false;
 }
 
+bool GetBatterySoC(FastbootDevice* device, const std::vector<std::string>& /* args */,
+                   std::string* message) {
+    int32_t battery_soc = 0;
+    if (GetBatterySoCHelper(device, &battery_soc)) {
+        *message = std::to_string(battery_soc);
+        return true;
+    }
+    *message = "Unable to get battery soc";
+    return false;
+}
+
 bool GetCurrentSlot(FastbootDevice* device, const std::vector<std::string>& /* args */,
                     std::string* message) {
     std::string suffix = device->GetCurrentSlot();
diff --git a/fastboot/device/variables.h b/fastboot/device/variables.h
index 3b2d484..9a46786 100644
--- a/fastboot/device/variables.h
+++ b/fastboot/device/variables.h
@@ -63,6 +63,8 @@
                            std::string* message);
 bool GetBatteryVoltage(FastbootDevice* device, const std::vector<std::string>& args,
                        std::string* message);
+bool GetBatterySoC(FastbootDevice* device, const std::vector<std::string>& args,
+                   std::string* message);
 bool GetBatterySoCOk(FastbootDevice* device, const std::vector<std::string>& args,
                      std::string* message);
 bool GetSuperPartitionName(FastbootDevice* device, const std::vector<std::string>& args,
diff --git a/fs_mgr/TEST_MAPPING b/fs_mgr/TEST_MAPPING
index 37b4988..324f50a 100644
--- a/fs_mgr/TEST_MAPPING
+++ b/fs_mgr/TEST_MAPPING
@@ -36,10 +36,10 @@
   ],
   "kernel-presubmit": [
     {
-      "name": "vts_libdm_test"
+      "name": "libdm_test"
     },
     {
-      "name": "vts_core_liblp_test"
+      "name": "liblp_test"
     },
     {
       "name": "vts_libsnapshot_test"
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/cow_compress.h b/fs_mgr/libsnapshot/include/libsnapshot/cow_compress.h
index fd12b84..8191d61 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/cow_compress.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/cow_compress.h
@@ -29,12 +29,14 @@
 
     virtual ~ICompressor() {}
     // Factory methods for compression methods.
-    static std::unique_ptr<ICompressor> Gz(uint32_t compression_level, const int32_t BLOCK_SZ);
-    static std::unique_ptr<ICompressor> Brotli(uint32_t compression_level, const int32_t BLOCK_SZ);
-    static std::unique_ptr<ICompressor> Lz4(uint32_t compression_level, const int32_t BLOCK_SZ);
-    static std::unique_ptr<ICompressor> Zstd(uint32_t compression_level, const int32_t BLOCK_SZ);
+    static std::unique_ptr<ICompressor> Gz(uint32_t compression_level, const int32_t block_size);
+    static std::unique_ptr<ICompressor> Brotli(uint32_t compression_level,
+                                               const int32_t block_size);
+    static std::unique_ptr<ICompressor> Lz4(uint32_t compression_level, const int32_t block_size);
+    static std::unique_ptr<ICompressor> Zstd(uint32_t compression_level, const int32_t block_size);
 
-    static std::unique_ptr<ICompressor> Create(CowCompression compression, const int32_t BLOCK_SZ);
+    static std::unique_ptr<ICompressor> Create(CowCompression compression,
+                                               const int32_t block_size);
 
     uint32_t GetCompressionLevel() const { return compression_level_; }
     uint32_t GetBlockSize() const { return block_size_; }
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h b/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h
index 2beeb9f..c9777a3 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h
@@ -91,6 +91,18 @@
 
     // Scratch space used during merge
     uint32_t buffer_size;
+
+} __attribute__((packed));
+
+struct CowHeaderV3 : public CowHeader {
+    // Location of sequence buffer in COW.
+    uint64_t sequence_buffer_offset;
+    // Size, in bytes, of the CowResumePoint buffer.
+    uint32_t resume_buffer_size;
+    // Size, in bytes, of the CowOperation buffer.
+    uint32_t op_buffer_size;
+    // Compression Algorithm
+    uint32_t compression_algorithm;
 } __attribute__((packed));
 
 // This structure is the same size of a normal Operation, but is repurposed for the footer.
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/cow_reader.h b/fs_mgr/libsnapshot/include/libsnapshot/cow_reader.h
index 1d6fd62..2721937 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/cow_reader.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/cow_reader.h
@@ -188,5 +188,7 @@
     uint8_t compression_type_ = kCowCompressNone;
 };
 
+bool ReadCowHeader(android::base::borrowed_fd fd, CowHeader* header);
+
 }  // namespace snapshot
 }  // namespace android
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp
index 85fd4c3..607d610 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp
@@ -33,6 +33,35 @@
 namespace android {
 namespace snapshot {
 
+bool ReadCowHeader(android::base::borrowed_fd fd, CowHeader* header) {
+    if (lseek(fd.get(), 0, SEEK_SET) < 0) {
+        PLOG(ERROR) << "lseek header failed";
+        return false;
+    }
+
+    memset(header, 0, sizeof(*header));
+
+    if (!android::base::ReadFully(fd, &header->prefix, sizeof(header->prefix))) {
+        return false;
+    }
+    if (header->prefix.magic != kCowMagicNumber) {
+        LOG(ERROR) << "Header Magic corrupted. Magic: " << header->prefix.magic
+                   << "Expected: " << kCowMagicNumber;
+        return false;
+    }
+    if (header->prefix.header_size > sizeof(CowHeader)) {
+        LOG(ERROR) << "Unknown CowHeader size (got " << header->prefix.header_size
+                   << " bytes, expected at most " << sizeof(CowHeader) << " bytes)";
+        return false;
+    }
+
+    if (lseek(fd.get(), 0, SEEK_SET) < 0) {
+        PLOG(ERROR) << "lseek header failed";
+        return false;
+    }
+    return android::base::ReadFully(fd, header, header->prefix.header_size);
+}
+
 CowReader::CowReader(ReaderFlags reader_flag, bool is_merge)
     : fd_(-1),
       header_(),
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.cpp
index 8edeae1..a7307bf 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.cpp
@@ -23,35 +23,6 @@
 
 using android::base::borrowed_fd;
 
-bool ReadCowHeader(android::base::borrowed_fd fd, CowHeader* header) {
-    if (lseek(fd.get(), 0, SEEK_SET) < 0) {
-        PLOG(ERROR) << "lseek header failed";
-        return false;
-    }
-
-    memset(header, 0, sizeof(*header));
-
-    if (!android::base::ReadFully(fd, &header->prefix, sizeof(header->prefix))) {
-        return false;
-    }
-    if (header->prefix.magic != kCowMagicNumber) {
-        LOG(ERROR) << "Header Magic corrupted. Magic: " << header->prefix.magic
-                   << "Expected: " << kCowMagicNumber;
-        return false;
-    }
-    if (header->prefix.header_size > sizeof(CowHeader)) {
-        LOG(ERROR) << "Unknown CowHeader size (got " << header->prefix.header_size
-                   << " bytes, expected at most " << sizeof(CowHeader) << " bytes)";
-        return false;
-    }
-
-    if (lseek(fd.get(), 0, SEEK_SET) < 0) {
-        PLOG(ERROR) << "lseek header failed";
-        return false;
-    }
-    return android::base::ReadFully(fd, header, header->prefix.header_size);
-}
-
 bool CowParserV2::Parse(borrowed_fd fd, const CowHeader& header, std::optional<uint64_t> label) {
     auto pos = lseek(fd.get(), 0, SEEK_END);
     if (pos < 0) {
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.h b/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.h
index 92e2b08..f51ff88 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.h
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.h
@@ -49,7 +49,5 @@
     std::optional<uint64_t> last_label_;
 };
 
-bool ReadCowHeader(android::base::borrowed_fd fd, CowHeader* header);
-
 }  // namespace snapshot
 }  // namespace android
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.h b/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.h
index cdf6222..709b248 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.h
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.h
@@ -63,7 +63,6 @@
     bool ValidateNewBlock(uint64_t new_block);
 
     CowOptions options_;
-    CowHeader header_{};
 
     android::base::unique_fd fd_;
     bool is_dev_null_ = false;
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.cpp
index e51dbde..a6f449f 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.cpp
@@ -243,7 +243,7 @@
 
     // Headers are not complete, but this ensures the file is at the right
     // position.
-    if (!android::base::WriteFully(fd_, &header_, sizeof(header_))) {
+    if (!android::base::WriteFully(fd_, &header_, sizeof(CowHeader))) {
         PLOG(ERROR) << "write failed";
         return false;
     }
@@ -262,7 +262,7 @@
         return false;
     }
 
-    if (lseek(fd_.get(), sizeof(header_) + header_.buffer_size, SEEK_SET) < 0) {
+    if (lseek(fd_.get(), sizeof(CowHeader) + header_.buffer_size, SEEK_SET) < 0) {
         PLOG(ERROR) << "lseek failed";
         return false;
     }
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.h b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.h
index ce97b01..24170eb 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.h
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.h
@@ -63,6 +63,7 @@
 
   private:
     CowFooter footer_{};
+    CowHeader header_{};
     CowCompression compression_;
     // in the case that we are using one thread for compression, we can store and re-use the same
     // compressor
diff --git a/trusty/fuzz/tipc_fuzzer.cpp b/trusty/fuzz/tipc_fuzzer.cpp
index f265ced..edc2a79 100644
--- a/trusty/fuzz/tipc_fuzzer.cpp
+++ b/trusty/fuzz/tipc_fuzzer.cpp
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#include <android-base/result.h>
+#include <fuzzer/FuzzedDataProvider.h>
 #include <stdlib.h>
 #include <trusty/coverage/coverage.h>
 #include <trusty/coverage/uuid.h>
@@ -23,6 +25,7 @@
 #include <iostream>
 #include <memory>
 
+using android::base::Result;
 using android::trusty::coverage::CoverageRecord;
 using android::trusty::fuzz::ExtraCounters;
 using android::trusty::fuzz::TrustyApp;
@@ -41,7 +44,14 @@
 #error "Binary file name must be parameterized using -DTRUSTY_APP_FILENAME."
 #endif
 
-static TrustyApp kTrustyApp(TIPC_DEV, TRUSTY_APP_PORT);
+#ifdef TRUSTY_APP_MAX_CONNECTIONS
+constexpr size_t MAX_CONNECTIONS = TRUSTY_APP_MAX_CONNECTIONS;
+#else
+constexpr size_t MAX_CONNECTIONS = 1;
+#endif
+
+static_assert(MAX_CONNECTIONS >= 1);
+
 static std::unique_ptr<CoverageRecord> record;
 
 extern "C" int LLVMFuzzerInitialize(int* /* argc */, char*** /* argv */) {
@@ -53,7 +63,8 @@
     }
 
     /* Make sure lazy-loaded TAs have started and connected to coverage service. */
-    auto ret = kTrustyApp.Connect();
+    TrustyApp ta(TIPC_DEV, TRUSTY_APP_PORT);
+    auto ret = ta.Connect();
     if (!ret.ok()) {
         std::cerr << ret.error() << std::endl;
         exit(-1);
@@ -73,24 +84,56 @@
     return 0;
 }
 
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-    static uint8_t buf[TIPC_MAX_MSG_SIZE];
+Result<void> testOneInput(FuzzedDataProvider& provider) {
+    std::vector<TrustyApp> trustyApps;
 
+    while (provider.remaining_bytes() > 0) {
+        if (trustyApps.size() < MAX_CONNECTIONS && provider.ConsumeBool()) {
+            auto& ta = trustyApps.emplace_back(TIPC_DEV, TRUSTY_APP_PORT);
+            const auto result = ta.Connect();
+            if (!result.ok()) {
+                return result;
+            }
+        } else {
+            const auto i = provider.ConsumeIntegralInRange<size_t>(0, trustyApps.size());
+            std::swap(trustyApps[i], trustyApps.back());
+
+            if (provider.ConsumeBool()) {
+                auto& ta = trustyApps.back();
+
+                const auto data = provider.ConsumeRandomLengthString();
+                auto result = ta.Write(data.data(), data.size());
+                if (!result.ok()) {
+                    return result;
+                }
+
+                std::array<uint8_t, TIPC_MAX_MSG_SIZE> buf;
+                result = ta.Read(buf.data(), buf.size());
+                if (!result.ok()) {
+                    return result;
+                }
+
+                // Reconnect to ensure that the service is still up.
+                ta.Disconnect();
+                result = ta.Connect();
+                if (!result.ok()) {
+                    std::cerr << result.error() << std::endl;
+                    android::trusty::fuzz::Abort();
+                    return result;
+                }
+            } else {
+                trustyApps.pop_back();
+            }
+        }
+    }
+    return {};
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
     ExtraCounters counters(record.get());
     counters.Reset();
 
-    auto ret = kTrustyApp.Write(data, size);
-    if (ret.ok()) {
-        ret = kTrustyApp.Read(&buf, sizeof(buf));
-    }
-
-    // Reconnect to ensure that the service is still up
-    kTrustyApp.Disconnect();
-    ret = kTrustyApp.Connect();
-    if (!ret.ok()) {
-        std::cerr << ret.error() << std::endl;
-        android::trusty::fuzz::Abort();
-    }
-
-    return ret.ok() ? 0 : -1;
+    FuzzedDataProvider provider(data, size);
+    const auto result = testOneInput(provider);
+    return result.ok() ? 0 : -1;
 }