diff --git a/debuggerd/Android.bp b/debuggerd/Android.bp
index 2529516..3a882ea 100644
--- a/debuggerd/Android.bp
+++ b/debuggerd/Android.bp
@@ -240,11 +240,16 @@
         "libdebuggerd/backtrace.cpp",
         "libdebuggerd/gwp_asan.cpp",
         "libdebuggerd/open_files_list.cpp",
+        "libdebuggerd/scudo.cpp",
         "libdebuggerd/tombstone.cpp",
         "libdebuggerd/tombstone_proto.cpp",
         "libdebuggerd/utility.cpp",
     ],
 
+    cflags: [
+        "-DUSE_SCUDO",
+    ],
+
     local_include_dirs: ["libdebuggerd/include"],
     export_include_dirs: ["libdebuggerd/include"],
 
@@ -256,6 +261,7 @@
         "bionic_libc_platform_headers",
         "gwp_asan_headers",
         "liblog_headers",
+        "scudo_headers",
     ],
 
     static_libs: [
@@ -273,6 +279,7 @@
         "libtombstone_proto",
         "libprocinfo",
         "libprotobuf-cpp-lite",
+        "libscudo",
     ],
 
     target: {
@@ -312,11 +319,9 @@
             cflags: ["-DROOT_POSSIBLE"],
         },
 
-        malloc_not_svelte: {
-            cflags: ["-DUSE_SCUDO"],
-            whole_static_libs: ["libscudo"],
-            srcs: ["libdebuggerd/scudo.cpp"],
-            header_libs: ["scudo_headers"],
+        malloc_low_memory: {
+            cflags: ["-UUSE_SCUDO"],
+            exclude_static_libs: ["libscudo"],
         },
     },
     apex_available: [
diff --git a/debuggerd/TEST_MAPPING b/debuggerd/TEST_MAPPING
index 61d7155..824d20a 100644
--- a/debuggerd/TEST_MAPPING
+++ b/debuggerd/TEST_MAPPING
@@ -4,6 +4,10 @@
       "name": "debuggerd_test"
     },
     {
+      "name": "debuggerd_test",
+      "keywords": ["primary-device"]
+    },
+    {
       "name": "libtombstoned_client_rust_test"
     },
     {
diff --git a/debuggerd/debuggerd_test.cpp b/debuggerd/debuggerd_test.cpp
index 7c52e6e..e4e2f99 100644
--- a/debuggerd/debuggerd_test.cpp
+++ b/debuggerd/debuggerd_test.cpp
@@ -1667,6 +1667,9 @@
 
   std::string result;
   ConsumeFd(std::move(output_fd), &result);
+  ASSERT_MATCH(
+      result,
+      R"(signal 6 \(SIGABRT\))");
   ASSERT_BACKTRACE_FRAME(result, "abort");
 }
 
diff --git a/debuggerd/libdebuggerd/include/libdebuggerd/scudo.h b/debuggerd/libdebuggerd/include/libdebuggerd/scudo.h
index a506859..89bf5a9 100644
--- a/debuggerd/libdebuggerd/include/libdebuggerd/scudo.h
+++ b/debuggerd/libdebuggerd/include/libdebuggerd/scudo.h
@@ -16,6 +16,8 @@
 
 #pragma once
 
+#if defined(USE_SCUDO)
+
 #include "types.h"
 #include "utility.h"
 
@@ -49,3 +51,5 @@
   void FillInCause(Cause* cause, const scudo_error_report* report,
                    unwindstack::AndroidUnwinder* unwinder) const;
 };
+
+#endif  // USE_SCUDO
diff --git a/debuggerd/libdebuggerd/scudo.cpp b/debuggerd/libdebuggerd/scudo.cpp
index 3fa3bd0..4ee87c8 100644
--- a/debuggerd/libdebuggerd/scudo.cpp
+++ b/debuggerd/libdebuggerd/scudo.cpp
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#if defined(USE_SCUDO)
+
 #include "libdebuggerd/scudo.h"
 #include "libdebuggerd/tombstone.h"
 
@@ -141,3 +143,5 @@
     FillInCause(tombstone->add_causes(), &error_info_.reports[report_num++], unwinder);
   }
 }
+
+#endif  // USE_SCUDO
diff --git a/debuggerd/libdebuggerd/tombstone.cpp b/debuggerd/libdebuggerd/tombstone.cpp
index 375ed8a..5a416d6 100644
--- a/debuggerd/libdebuggerd/tombstone.cpp
+++ b/debuggerd/libdebuggerd/tombstone.cpp
@@ -76,7 +76,7 @@
   threads[target_tid] = ThreadInfo {
     .registers = std::move(regs), .uid = uid, .tid = target_tid,
     .thread_name = std::move(thread_name), .pid = pid, .command_line = std::move(command_line),
-    .selinux_label = std::move(selinux_label), .siginfo = siginfo,
+    .selinux_label = std::move(selinux_label), .siginfo = siginfo, .signo = siginfo->si_signo,
     // Only supported on aarch64 for now.
 #if defined(__aarch64__)
     .tagged_addr_ctrl = prctl(PR_GET_TAGGED_ADDR_CTRL, 0, 0, 0, 0),
diff --git a/fs_mgr/fs_mgr.cpp b/fs_mgr/fs_mgr.cpp
index 8c0c1ef..835a3e7 100644
--- a/fs_mgr/fs_mgr.cpp
+++ b/fs_mgr/fs_mgr.cpp
@@ -40,6 +40,7 @@
 #include <functional>
 #include <map>
 #include <memory>
+#include <numeric>
 #include <string>
 #include <string_view>
 #include <thread>
@@ -1553,7 +1554,9 @@
                     fs_mgr_set_blk_ro(attempted_entry.blk_device, false);
                     if (!call_vdc({"cryptfs", "encryptFstab", attempted_entry.blk_device,
                                    attempted_entry.mount_point, wiped ? "true" : "false",
-                                   attempted_entry.fs_type, attempted_entry.zoned_device},
+                                   attempted_entry.fs_type,
+                                   attempted_entry.fs_mgr_flags.is_zoned ? "true" : "false",
+                                   android::base::Join(attempted_entry.user_devices, ' ')},
                                   nullptr)) {
                         LERROR << "Encryption failed";
                         set_type_property(encryptable);
@@ -1596,7 +1599,9 @@
 
                 if (!call_vdc({"cryptfs", "encryptFstab", current_entry.blk_device,
                                current_entry.mount_point, "true" /* shouldFormat */,
-                               current_entry.fs_type, current_entry.zoned_device},
+                               current_entry.fs_type,
+                               current_entry.fs_mgr_flags.is_zoned ? "true" : "false",
+                               android::base::Join(current_entry.user_devices, ' ')},
                               nullptr)) {
                     LERROR << "Encryption failed";
                 } else {
@@ -1621,7 +1626,9 @@
         if (mount_errno != EBUSY && mount_errno != EACCES &&
             should_use_metadata_encryption(attempted_entry)) {
             if (!call_vdc({"cryptfs", "mountFstab", attempted_entry.blk_device,
-                           attempted_entry.mount_point, attempted_entry.zoned_device},
+                           attempted_entry.mount_point,
+                           current_entry.fs_mgr_flags.is_zoned ? "true" : "false",
+                           android::base::Join(current_entry.user_devices, ' ')},
                           nullptr)) {
                 ++error_count;
             } else if (current_entry.mount_point == "/data") {
diff --git a/fs_mgr/fs_mgr_format.cpp b/fs_mgr/fs_mgr_format.cpp
index 8e76150..0dde1d3 100644
--- a/fs_mgr/fs_mgr_format.cpp
+++ b/fs_mgr/fs_mgr_format.cpp
@@ -125,7 +125,8 @@
 }
 
 static int format_f2fs(const std::string& fs_blkdev, uint64_t dev_sz, bool needs_projid,
-                       bool needs_casefold, bool fs_compress, const std::string& zoned_device) {
+                       bool needs_casefold, bool fs_compress, bool is_zoned,
+                       const std::vector<std::string>& user_devices) {
     if (!dev_sz) {
         int rc = get_dev_sz(fs_blkdev, &dev_sz);
         if (rc) {
@@ -159,16 +160,21 @@
     args.push_back(block_size.c_str());
     args.push_back("-b");
     args.push_back(block_size.c_str());
-    if (!zoned_device.empty()) {
-        args.push_back("-c");
-        args.push_back(zoned_device.c_str());
+
+    if (is_zoned) {
         args.push_back("-m");
-        args.push_back(fs_blkdev.c_str());
-    } else {
-        args.push_back(fs_blkdev.c_str());
-        args.push_back(size_str.c_str());
+    }
+    for (auto& device : user_devices) {
+        args.push_back("-c");
+        args.push_back(device.c_str());
     }
 
+    if (user_devices.empty()) {
+        args.push_back(fs_blkdev.c_str());
+        args.push_back(size_str.c_str());
+    } else {
+        args.push_back(fs_blkdev.c_str());
+    }
     return logwrap_fork_execvp(args.size(), args.data(), nullptr, false, LOG_KLOG, false, nullptr);
 }
 
@@ -184,7 +190,8 @@
 
     if (entry.fs_type == "f2fs") {
         return format_f2fs(entry.blk_device, entry.length, needs_projid, needs_casefold,
-                           entry.fs_mgr_flags.fs_compress, entry.zoned_device);
+                           entry.fs_mgr_flags.fs_compress, entry.fs_mgr_flags.is_zoned,
+                           entry.user_devices);
     } else if (entry.fs_type == "ext4") {
         return format_ext4(entry.blk_device, entry.mount_point, needs_projid,
                            entry.fs_mgr_flags.ext_meta_csum);
diff --git a/fs_mgr/libfstab/fstab.cpp b/fs_mgr/libfstab/fstab.cpp
index 6273ee2..f00e0dc 100644
--- a/fs_mgr/libfstab/fstab.cpp
+++ b/fs_mgr/libfstab/fstab.cpp
@@ -147,6 +147,29 @@
     entry->fs_options = std::move(fs_options);
 }
 
+void ParseUserDevices(const std::string& arg, FstabEntry* entry) {
+    auto param = Split(arg, ":");
+    if (param.size() != 2) {
+        LWARNING << "Warning: device= malformed: " << arg;
+        return;
+    }
+
+    if (access(param[1].c_str(), F_OK) != 0) {
+        LWARNING << "Warning: device does not exist : " << param[1];
+        return;
+    }
+
+    if (param[0] == "zoned") {
+        // atgc in f2fs does not support a zoned device
+        auto options = Split(entry->fs_options, ",");
+        options.erase(std::remove(options.begin(), options.end(), "atgc"), options.end());
+        entry->fs_options = android::base::Join(options, ",");
+        LINFO << "Removed ATGC in fs_options as " << entry->fs_options << " for zoned device";
+        entry->fs_mgr_flags.is_zoned = true;
+    }
+    entry->user_devices.push_back(param[1]);
+}
+
 bool ParseFsMgrFlags(const std::string& flags, FstabEntry* entry) {
     for (const auto& flag : Split(flags, ",")) {
         if (flag.empty() || flag == "defaults") continue;
@@ -311,17 +334,8 @@
             if (!ParseByteCount(arg, &entry->zram_backingdev_size)) {
                 LWARNING << "Warning: zram_backingdev_size= flag malformed: " << arg;
             }
-        } else if (flag == "zoned_device") {
-            if (access("/dev/block/by-name/zoned_device", F_OK) == 0) {
-                entry->zoned_device = "/dev/block/by-name/zoned_device";
-
-                // atgc in f2fs does not support a zoned device
-                auto options = Split(entry->fs_options, ",");
-                options.erase(std::remove(options.begin(), options.end(), "atgc"), options.end());
-                entry->fs_options = android::base::Join(options, ",");
-                LINFO << "Removed ATGC in fs_options as " << entry->fs_options
-                      << " for zoned device=" << entry->zoned_device;
-            }
+        } else if (StartsWith(flag, "device=")) {
+            ParseUserDevices(arg, entry);
         } else {
             LWARNING << "Warning: unknown flag: " << flag;
         }
diff --git a/fs_mgr/libfstab/include/fstab/fstab.h b/fs_mgr/libfstab/include/fstab/fstab.h
index dea7238..1696daf 100644
--- a/fs_mgr/libfstab/include/fstab/fstab.h
+++ b/fs_mgr/libfstab/include/fstab/fstab.h
@@ -32,7 +32,7 @@
 
 struct FstabEntry {
     std::string blk_device;
-    std::string zoned_device;
+    std::vector<std::string> user_devices;
     std::string logical_partition_name;
     std::string mount_point;
     std::string fs_type;
@@ -85,6 +85,7 @@
         bool ext_meta_csum : 1;
         bool fs_compress : 1;
         bool overlayfs_remove_missing_lowerdir : 1;
+        bool is_zoned : 1;
     } fs_mgr_flags = {};
 
     bool is_encryptable() const { return fs_mgr_flags.crypt; }
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v3.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v3.cpp
index 95398e4..1117ec9 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v3.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v3.cpp
@@ -731,7 +731,8 @@
             i += chunk;
         }
         if (total_written != total_data_size) {
-            PLOG(ERROR) << "write failed for data of size: " << data.size()
+            PLOG(ERROR) << "write failed for data vector of size: " << data.size()
+                        << " and total data length: " << total_data_size
                         << " at offset: " << next_data_pos_ << " " << errno
                         << ", only wrote: " << total_written;
             return false;
diff --git a/init/Android.bp b/init/Android.bp
index c4e74d0..6160a71 100644
--- a/init/Android.bp
+++ b/init/Android.bp
@@ -96,7 +96,6 @@
     config_namespace: "ANDROID",
     bool_variables: [
         "PRODUCT_INSTALL_DEBUG_POLICY_TO_SYSTEM_EXT",
-        "release_write_appcompat_override_system_properties",
     ],
     properties: [
         "cflags",
@@ -160,9 +159,6 @@
                 "-DINSTALL_DEBUG_POLICY_TO_SYSTEM_EXT=1",
             ],
         },
-        release_write_appcompat_override_system_properties: {
-            cflags: ["-DWRITE_APPCOMPAT_OVERRIDE_SYSTEM_PROPERTIES"],
-        }
     },
     static_libs: [
         "libavb",
@@ -330,7 +326,7 @@
     recovery_available: false,
     static_libs: ["libinit.microdroid"],
     cflags: ["-DMICRODROID=1"],
-    installable: false,
+    no_full_install: true,
     visibility: ["//packages/modules/Virtualization/microdroid"],
 }
 
@@ -456,6 +452,7 @@
 
         // First stage init is weird: it may start without stdout/stderr, and no /proc.
         hwaddress: false,
+        memtag_stack: false,
     },
 
     // Install adb_debug.prop into debug ramdisk.
@@ -479,7 +476,7 @@
         "init_first_stage_defaults",
     ],
     cflags: ["-DMICRODROID=1"],
-    installable: false,
+    no_full_install: true,
 }
 
 phony {
diff --git a/init/property_service.cpp b/init/property_service.cpp
index 5a1b63b..d3cdd43 100644
--- a/init/property_service.cpp
+++ b/init/property_service.cpp
@@ -453,6 +453,10 @@
                                    SocketConnection* socket, std::string* error) {
     auto lock = std::lock_guard{accept_messages_lock};
     if (!accept_messages) {
+        // If we're already shutting down and you're asking us to stop something,
+        // just say we did (https://issuetracker.google.com/336223505).
+        if (msg == "stop") return PROP_SUCCESS;
+
         *error = "Received control message after shutdown, ignoring";
         return PROP_ERROR_HANDLE_CONTROL_MESSAGE;
     }
@@ -1308,14 +1312,12 @@
     }
     selinux_android_restorecon(PROP_TREE_FILE, 0);
 
-#ifdef WRITE_APPCOMPAT_OVERRIDE_SYSTEM_PROPERTIES
     mkdir(APPCOMPAT_OVERRIDE_PROP_FOLDERNAME, S_IRWXU | S_IXGRP | S_IXOTH);
     if (!WriteStringToFile(serialized_contexts, APPCOMPAT_OVERRIDE_PROP_TREE_FILE, 0444, 0, 0,
                            false)) {
         PLOG(ERROR) << "Unable to write appcompat override property infos to file";
     }
     selinux_android_restorecon(APPCOMPAT_OVERRIDE_PROP_TREE_FILE, 0);
-#endif
 }
 
 static void ExportKernelBootProps() {
diff --git a/libvendorsupport/Android.bp b/libvendorsupport/Android.bp
index e87959e..a22737c 100644
--- a/libvendorsupport/Android.bp
+++ b/libvendorsupport/Android.bp
@@ -23,7 +23,7 @@
     llndk: {
         symbol_file: "libvendorsupport.map.txt",
     },
-    srcs: ["version_props.c"],
+    srcs: ["version_props.cpp"],
     cflags: [
         "-Wall",
         "-Werror",
@@ -32,6 +32,7 @@
     export_include_dirs: ["include"],
     shared_libs: [
         "liblog",
+        "libbase",
     ],
 }
 
diff --git a/libvendorsupport/include/vendorsupport/api_level.h b/libvendorsupport/include/vendorsupport/api_level.h
index d365075..3427bc6 100644
--- a/libvendorsupport/include/vendorsupport/api_level.h
+++ b/libvendorsupport/include/vendorsupport/api_level.h
@@ -44,4 +44,22 @@
  */
 int AVendorSupport_getSdkApiLevelOf(int vendorApiLevel);
 
+#if !defined(__ANDROID_VENDOR__)
+/**
+ * @brief Provide vendor API level to system modules.
+ *
+ * @details
+ * Before deprecating VNDK, system modules read ro.vndk.version to find the
+ * API level that vendor image had implemented. With the VNDK deprecation, this
+ * must be replaced with ro.board.api_level. However, there still are devices
+ * keeping old vendor partitions with the new system upgraded. In this case, the
+ * VNDK version can be used as before.
+ * This API is for platform only.
+ *
+ * @return ro.vndk.version if exist. Otherwise fallback to ro.board.api_level.
+ * 0 if none of these properties are found. This is unexpected, though.
+ */
+int AVendorSupport_getVendorApiLevel();
+#endif  // __ANDROID_VENDOR__
+
 __END_DECLS
diff --git a/libvendorsupport/version_props.c b/libvendorsupport/version_props.cpp
similarity index 79%
rename from libvendorsupport/version_props.c
rename to libvendorsupport/version_props.cpp
index 835828c..ecba899 100644
--- a/libvendorsupport/version_props.c
+++ b/libvendorsupport/version_props.cpp
@@ -16,6 +16,10 @@
 
 #include <log/log.h>
 
+#if !defined(__ANDROID_VENDOR__)
+#include <android-base/properties.h>
+#endif
+
 int AVendorSupport_getVendorApiLevelOf(int sdkApiLevel) {
     if (sdkApiLevel < __ANDROID_API_V__) {
         return sdkApiLevel;
@@ -39,3 +43,13 @@
     ALOGE("Unexpected vendor api level: %d", vendorApiLevel);
     return __INVALID_API_LEVEL;
 }
+
+#if !defined(__ANDROID_VENDOR__)
+int AVendorSupport_getVendorApiLevel() {
+    int vendorApiLevel = android::base::GetIntProperty("ro.vndk.version", 0);
+    if (vendorApiLevel) {
+        return vendorApiLevel;
+    }
+    return android::base::GetIntProperty("ro.board.api_level", 0);
+}
+#endif  // __ANDROID_VENDOR__
diff --git a/rootdir/Android.mk b/rootdir/Android.mk
index fb91b58..2394b14 100644
--- a/rootdir/Android.mk
+++ b/rootdir/Android.mk
@@ -72,9 +72,9 @@
 EXPORT_GLOBAL_CLANG_COVERAGE_OPTIONS :=
 ifeq ($(CLANG_COVERAGE),true)
   ifeq ($(CLANG_COVERAGE_CONTINUOUS_MODE),true)
-    EXPORT_GLOBAL_CLANG_COVERAGE_OPTIONS := export LLVM_PROFILE_FILE /data/misc/trace/clang%c-%20m.profraw
+    EXPORT_GLOBAL_CLANG_COVERAGE_OPTIONS := export LLVM_PROFILE_FILE /data/local/tmp/clang%c-%20m.profraw
   else
-    EXPORT_GLOBAL_CLANG_COVERAGE_OPTIONS := export LLVM_PROFILE_FILE /data/misc/trace/clang-%20m.profraw
+    EXPORT_GLOBAL_CLANG_COVERAGE_OPTIONS := export LLVM_PROFILE_FILE /data/local/tmp/clang-%20m.profraw
   endif
 endif
 
diff --git a/shell_and_utilities/README.md b/shell_and_utilities/README.md
index 9a733bb..c7c622e 100644
--- a/shell_and_utilities/README.md
+++ b/shell_and_utilities/README.md
@@ -37,7 +37,46 @@
 full list for a release by running `toybox` directly.
 
 
-## Android 14 ("U")
+## Android 15 (API level 35, "Vanilla Ice Cream")
+
+BSD: fsck\_msdos newfs\_msdos
+
+bzip2: bzcat bzip2 bunzip2
+
+gavinhoward/bc: bc
+
+one-true-awk: awk
+
+toolbox: getevent getprop setprop start stop
+
+toybox ([0.8.11](https://landley.net/toybox/news.html#08-04-2024)-ish):
+[ acpi base64 basename blkdiscard blkid blockdev brctl cal cat chattr
+chcon chgrp chmod chown chroot chrt cksum clear cmp comm cp cpio cut
+date dd devmem df diff dirname dmesg dos2unix du echo egrep env expand
+expr fallocate false fgrep file find flock fmt free freeramdisk fsfreeze
+fsync getconf getenforce **getfattr** getopt **gpiodetect** **gpiofind**
+**gpioget** **gpioinfo** **gpioset** grep groups gunzip gzip head help hostname
+hwclock i2cdetect i2cdump i2cget i2cset **i2ctransfer** iconv id ifconfig
+inotifyd insmod install ionice iorenice iotop kill killall ln load\_policy
+log logger logname losetup ls lsattr lsmod lsof lspci lsusb makedevs
+md5sum **memeater** microcom mkdir mkfifo mknod mkswap mktemp modinfo modprobe
+more mount mountpoint mv nbd-client nc netcat netstat nice nl nohup
+nproc nsenter od partprobe paste patch pgrep pidof ping ping6 pivot\_root
+pkill pmap printenv printf prlimit ps pwd pwdx readelf readlink realpath
+renice restorecon rev rfkill rm rmdir rmmod rtcwake runcon sed sendevent
+seq setenforce **setfattr** setsid sha1sum sha224sum sha256sum sha384sum
+sha512sum sleep sort split stat strings stty swapoff swapon sync sysctl
+tac tail tar taskset tee test time timeout top touch tr traceroute
+traceroute6 true truncate tty tunctl uclampset ulimit umount uname
+uniq unix2dos unlink unshare uptime usleep uudecode uuencode uuidgen
+vconfig vi vmstat watch wc which whoami xargs xxd yes zcat
+
+Note: technically getfattr and setfattr were available in earlier versions,
+but the symlinks were missing until this release, so they were only available
+as `toybox getfattr` and `toybox setfattr` rather than directly.
+
+
+## Android 14 (API level 34, "Upside Down Cake")
 
 BSD: fsck\_msdos newfs\_msdos
 
@@ -71,7 +110,7 @@
 vconfig vi vmstat watch wc which whoami xargs xxd yes zcat
 
 
-## Android 13 ("T")
+## Android 13 (33, "Tiramisu")
 
 BSD: fsck\_msdos newfs\_msdos
 
@@ -105,7 +144,7 @@
 vconfig vi vmstat watch wc which whoami xargs xxd yes zcat
 
 
-## Android 12 ("S")
+## Android 12 (31, "Snow Cone")
 
 BSD: fsck\_msdos newfs\_msdos
 
@@ -139,7 +178,7 @@
 vmstat watch wc which whoami xargs xxd yes zcat
 
 
-## Android 11 ("R")
+## Android 11 (API level 30, "Red Velvet Cake")
 
 BSD: fsck\_msdos newfs\_msdos
 
@@ -173,7 +212,7 @@
 whoami xargs xxd yes zcat
 
 
-## Android 10 ("Q")
+## Android 10 (API level 29, "Quince Tart")
 
 BSD: grep fsck\_msdos newfs\_msdos
 
@@ -205,7 +244,7 @@
 wc which whoami xargs xxd yes zcat
 
 
-## Android 9.0 (Pie)
+## Android 9.0 (API level 28, "Pie")
 
 BSD: dd grep
 
@@ -232,7 +271,7 @@
 which whoami xargs xxd yes zcat
 
 
-## Android 8.0 (Oreo)
+## Android 8.0 (API level 26, "Oreo")
 
 BSD: dd grep
 
@@ -257,7 +296,7 @@
 vmstat wc which whoami xargs xxd yes **zcat**
 
 
-## Android 7.0 (Nougat)
+## Android 7.0 (API level 24, "Nougat")
 
 BSD: dd grep
 
@@ -279,7 +318,7 @@
 **uptime** usleep vmstat wc which whoami xargs **xxd** yes
 
 
-## Android 6.0 (Marshmallow)
+## Android 6.0 (API level 23, "Marshmallow")
 
 BSD: dd du grep
 
@@ -300,7 +339,7 @@
 vmstat wc which whoami xargs yes
 
 
-## Android 5.0 (Lollipop)
+## Android 5.0 (API level 21, "Lollipop")
 
 BSD: cat chown cp dd du grep kill ln mv printenv rm rmdir sleep sync
 
@@ -312,7 +351,7 @@
 top touch umount uptime vmstat watchprops wipe
 
 
-## Android 4.4 (KitKat)
+## Android 4.4 (API level 19, "KitKat")
 
 BSD: cat cp dd du grep newfs\_msdos
 
@@ -324,7 +363,7 @@
 stop swapoff swapon sync top touch umount uptime vmstat watchprops wipe
 
 
-## Android 4.1-4.3 (JellyBean)
+## Android 4.1-4.3 (API level 16, "Jelly Bean")
 
 BSD: cat cp dd du grep newfs\_msdos
 
@@ -336,7 +375,7 @@
 sync top touch umount uptime vmstat watchprops wipe
 
 
-## Android 4.0 (IceCreamSandwich)
+## Android 4.0 (API level 14, "Ice Cream Sandwich")
 
 BSD: cat dd newfs\_msdos
 
@@ -347,7 +386,7 @@
 touch umount uptime vmstat watchprops wipe
 
 
-## Android 2.3 (Gingerbread)
+## Android 2.3 (API level 9, "Gingerbread")
 
 BSD: cat dd newfs\_msdos
 
diff --git a/trusty/line-coverage/coverage.cpp b/trusty/line-coverage/coverage.cpp
index 5f7b3a3..e4db59c 100644
--- a/trusty/line-coverage/coverage.cpp
+++ b/trusty/line-coverage/coverage.cpp
@@ -174,7 +174,7 @@
     }
 
     uintptr_t* begin = (uintptr_t*)((char *)shm_ + sizeof(struct control));
-    bool ret = WriteFully(output_fd, begin, record_len_);
+    bool ret = WriteFully(output_fd, begin, record_len_ - sizeof(struct control));
     if(!ret) {
         fprintf(stderr, "Coverage write to file failed\n");
     }