diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index b7364bd..6ea7679 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -190,7 +190,6 @@
 		"android.system.virtualizationservice_internal.IVfioHandler":          EXCEPTION_NO_FUZZER,
 		"android.system.virtualizationservice_internal.IVmnic":                EXCEPTION_NO_FUZZER,
 		"android.system.virtualizationmaintenance":                            EXCEPTION_NO_FUZZER,
-		"android.system.vmtethering.IVmTethering":                             EXCEPTION_NO_FUZZER,
 		"ambient_context":               EXCEPTION_NO_FUZZER,
 		"app_binding":                   EXCEPTION_NO_FUZZER,
 		"app_hibernation":               EXCEPTION_NO_FUZZER,
diff --git a/private/crosvm.te b/private/crosvm.te
index cddab36..0c2acb9 100644
--- a/private/crosvm.te
+++ b/private/crosvm.te
@@ -135,7 +135,7 @@
 is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
     # Allow crosvm to deal with file descriptors of TAP interfaces.
     allow crosvm tun_device:chr_file rw_file_perms;
-    allowxperm crosvm tun_device:chr_file ioctl { TUNGETIFF TUNSETVNETHDRSZ };
+    allowxperm crosvm tun_device:chr_file ioctl { TUNGETIFF TUNSETOFFLOAD TUNSETVNETHDRSZ };
     allow crosvm self:udp_socket create_socket_perms;
     allowxperm crosvm self:udp_socket ioctl SIOCGIFMTU;
     allow crosvm vmnic:fd use;
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 6d5f0b3..38ea999 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -258,6 +258,12 @@
   system_suspend_server
 }:process signal;
 
+# On userdebug, dumpstate may fork and execute a command as su. Make sure the
+# timeout logic is allowed to terminate the child process if necessary.
+userdebug_or_eng(`
+  allow dumpstate su:process { signal sigkill };
+')
+
 # Connect to tombstoned to intercept dumps.
 unix_socket_connect(dumpstate, tombstoned_intercept, tombstoned)
 
diff --git a/private/service.te b/private/service.te
index 6c55ed4..1fb4d1d 100644
--- a/private/service.te
+++ b/private/service.te
@@ -31,8 +31,7 @@
     type virtualization_maintenance_service, service_manager_type;
 ')
 is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
-    type vm_tethering_service, system_server_service, service_manager_type;
-    type vmnic_service,        service_manager_type;
+    type vmnic_service, service_manager_type;
 ')
 
 type uce_service,                   service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index d1eecd5..c7917f1 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -172,7 +172,6 @@
 ')
 is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
     android.system.virtualizationservice_internal.IVmnic u:object_r:vmnic_service:s0
-    android.system.vmtethering.IVmTethering              u:object_r:vm_tethering_service:s0
 ')
 ambient_context                           u:object_r:ambient_context_service:s0
 app_binding                               u:object_r:app_binding_service:s0
diff --git a/private/shell.te b/private/shell.te
index 263db8c..e421ec6 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -436,6 +436,9 @@
   allowxperm shell vmlauncher_app_devpts:chr_file ioctl unpriv_tty_ioctls;
 ')
 
+# Allow CTS to check whether AVF debug policy is installed
+allow shell { proc_dt_avf sysfs_dt_avf }:dir search;
+
 # Allow access to ion memory allocation device.
 allow shell ion_device:chr_file rw_file_perms;
 
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index b6ba55b..3d0aac0 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -28,7 +28,6 @@
     # Let virtualizationservice find and communicate with vmnic.
     allow virtualizationservice vmnic_service:service_manager find;
     binder_call(virtualizationservice, vmnic)
-    allow virtualizationservice vm_tethering_service:service_manager find;
 ')
 
 # Allow the virtualizationservice domain to serve a remotely provisioned component for
diff --git a/private/vmnic.te b/private/vmnic.te
index 1b7e0d8..4a706df 100644
--- a/private/vmnic.te
+++ b/private/vmnic.te
@@ -17,7 +17,7 @@
     allow vmnic self:global_capability_class_set net_admin;
     allow vmnic self:tun_socket create_socket_perms_no_ioctl;
     allow vmnic tun_device:chr_file rw_file_perms;
-    allowxperm vmnic tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF TUNSETPERSIST };
+    allowxperm vmnic tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF };
     allow vmnic self:udp_socket create_socket_perms;
     allowxperm vmnic self:udp_socket ioctl SIOCSIFFLAGS;