diff --git a/configs/msmcobalt/mixer_paths_tavil.xml b/configs/msmcobalt/mixer_paths_tavil.xml
index dab6cac..b9b0b03 100644
--- a/configs/msmcobalt/mixer_paths_tavil.xml
+++ b/configs/msmcobalt/mixer_paths_tavil.xml
@@ -45,10 +45,14 @@
     <ctl name="Voip Evrc Min Max Rate Config" id="1" value="4" />
     <ctl name="Voip Dtx Mode" value="0" />
     <ctl name="TTY Mode" value="OFF" />
+    <ctl name="DEC0 Volume" value="84" />
+    <ctl name="DEC2 Volume" value="84" />
     <ctl name="DEC5 Volume" value="84" />
     <ctl name="DEC6 Volume" value="84" />
     <ctl name="DEC7 Volume" value="84" />
     <ctl name="DEC8 Volume" value="84" />
+    <ctl name="ADC1 Volume" value="12" />
+    <ctl name="ADC2 Volume" value="12" />
     <ctl name="CDC_IF TX5 MUX" value="ZERO" />
     <ctl name="CDC_IF TX6 MUX" value="ZERO" />
     <ctl name="CDC_IF TX7 MUX" value="ZERO" />
@@ -61,6 +65,8 @@
     <ctl name="DMIC MUX6" value="ZERO" />
     <ctl name="DMIC MUX7" value="ZERO" />
     <ctl name="DMIC MUX8" value="ZERO" />
+    <ctl name="AMIC MUX0" value="ZERO" />
+    <ctl name="AMIC MUX6" value="ZERO" />
     <ctl name="SLIMBUS_0_RX Port Mixer SLIM_0_TX" value="0" />
     <ctl name="SLIMBUS_7_RX Audio Mixer MultiMedia1" value="0" />
     <ctl name="SLIMBUS_7_RX Audio Mixer MultiMedia4" value="0" />
@@ -372,8 +378,6 @@
     <ctl name="RX INT2 MIX3 DSD HPHR Switch" value="0" />
     <ctl name="RX INT1 DEM MUX" value="CLSH_DSM_OUT" />
     <ctl name="RX INT2 DEM MUX" value="CLSH_DSM_OUT" />
-    <ctl name="AIF1_CAP Mixer SLIM TX0" value="0" />
-    <ctl name="AIF1_CAP Mixer SLIM TX2" value="0" />
     <ctl name="CDC_IF TX0 MUX" value="ZERO" />
     <ctl name="CDC_IF TX2 MUX" value="ZERO" />
     <ctl name="ADC MUX0" value="ZERO" />
@@ -381,8 +385,6 @@
     <ctl name="DMIC MUX0" value="ZERO" />
     <ctl name="DMIC MUX2" value="ZERO" />
 
-    <ctl name="DEC0 Volume" value="0" />
-    <ctl name="DEC2 Volume" value="0" />
     <ctl name="RX7 Digital Volume" value="84" />
     <ctl name="RX8 Digital Volume" value="84" />
 
@@ -1380,9 +1382,19 @@
 
     <!-- These are actual sound device specific mixer settings -->
     <path name="amic1">
+        <ctl name="AIF1_CAP Mixer SLIM TX6" value="1"/>
+        <ctl name="SLIM_0_TX Channels" value="One" />
+        <ctl name="CDC_IF TX6 MUX" value="DEC6" />
+        <ctl name="ADC MUX6" value="AMIC" />
+        <ctl name="AMIC MUX6" value="ADC1" />
     </path>
 
     <path name="amic2">
+        <ctl name="AIF1_CAP Mixer SLIM TX0" value="1"/>
+        <ctl name="SLIM_0_TX Channels" value="One" />
+        <ctl name="CDC_IF TX0 MUX" value="DEC0" />
+        <ctl name="ADC MUX0" value="AMIC" />
+        <ctl name="AMIC MUX0" value="ADC2" />
     </path>
 
     <!-- For Tavil, DMIC numbered from 0 to 5 -->
diff --git a/configs/msmcobalt/sound_trigger_platform_info.xml b/configs/msmcobalt/sound_trigger_platform_info.xml
index 1f90bd5..7ce74aa 100644
--- a/configs/msmcobalt/sound_trigger_platform_info.xml
+++ b/configs/msmcobalt/sound_trigger_platform_info.xml
@@ -63,6 +63,15 @@
             <param detection_event_ids="0x00012C0D, 0x0, 0x00012C29" />
             <param capture_event_ids="0x00020013, 0x0,0x00020015" />
         </gcs_uid>
+        <gcs_uid>
+            <param uid="0x2" />
+            <param did="0x4" />
+            <param load_sound_model_ids="0x00012C0D, 0x1, 0x00012C14" />
+            <param confidence_levels_ids="0x00012C0D, 0x1, 0x00012C28" />
+            <param operation_mode_ids="0x00012C0D, 0x1 0x00012C28" />
+            <param detection_event_ids="0x00012C0D, 0x1, 0x00012C29" />
+            <param capture_event_ids="0x00020013, 0x1,0x00020015" />
+        </gcs_uid>
 
         <!-- Module and param ids with which the algorithm is integrated
             in non-graphite firmware (note these must come after gcs params) -->
diff --git a/hal/audio_hw.c b/hal/audio_hw.c
index 7d3c824..43c83de 100644
--- a/hal/audio_hw.c
+++ b/hal/audio_hw.c
@@ -4109,7 +4109,7 @@
             ALOGV("cache new edid");
             platform_cache_edid(adev->platform);
         } else if ((val & AUDIO_DEVICE_OUT_USB_DEVICE) ||
-                   (val & AUDIO_DEVICE_IN_USB_DEVICE)) {
+                   !(val ^ AUDIO_DEVICE_IN_USB_DEVICE)) {
             /*
              * Do not allow AFE proxy port usage by WFD source when USB headset is connected.
              * Per AudioPolicyManager, USB device is higher priority than WFD.
@@ -4133,7 +4133,7 @@
             ALOGV("invalidate cached edid");
             platform_invalidate_hdmi_config(adev->platform);
         } else if ((val & AUDIO_DEVICE_OUT_USB_DEVICE) ||
-                   (val & AUDIO_DEVICE_IN_USB_DEVICE)) {
+                   !(val ^ AUDIO_DEVICE_IN_USB_DEVICE)) {
             ret = str_parms_get_str(parms, "card", value, sizeof(value));
             if (ret >= 0) {
                 audio_extn_usb_remove_device(val, atoi(value));
diff --git a/post_proc/bundle.c b/post_proc/bundle.c
index 464bc0d..fd5ee8c 100644
--- a/post_proc/bundle.c
+++ b/post_proc/bundle.c
@@ -852,8 +852,9 @@
         if (pCmdData == NULL ||
             cmdSize < (int)(sizeof(effect_param_t) + sizeof(uint32_t)) ||
             pReplyData == NULL ||
-            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) +
-                               sizeof(uint16_t))) {
+            *replySize < (int)(sizeof(effect_param_t) + sizeof(uint32_t) + sizeof(uint16_t)) ||
+            // constrain memcpy below
+            ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {
             status = -EINVAL;
             ALOGW("EFFECT_CMD_GET_PARAM invalid command cmdSize %d *replySize %d",
                   cmdSize, *replySize);
diff --git a/voice_processing/voice_processing.c b/voice_processing/voice_processing.c
index 1e1e123..610bee6 100644
--- a/voice_processing/voice_processing.c
+++ b/voice_processing/voice_processing.c
@@ -565,7 +565,9 @@
             if (pCmdData == NULL ||
                     cmdSize < (int)sizeof(effect_param_t) ||
                     pReplyData == NULL ||
-                    *replySize < (int)sizeof(effect_param_t)) {
+                    *replySize < (int)sizeof(effect_param_t) ||
+                    // constrain memcpy below
+                    ((effect_param_t *)pCmdData)->psize > *replySize - sizeof(effect_param_t)) {
                 ALOGV("fx_command() EFFECT_CMD_GET_PARAM invalid args");
                 return -EINVAL;
             }