1046 – Broadcom: Heap overflow in TDLS Teardown Request while handling Fast Transition IE: your phone can be taken over using rogue wifi signals
Source: 1046 – Broadcom: Heap overflow in TDLS Teardown Request while handling Fast Transition IE – project-zero – Monorail Comes with proof of concept code