diff --git a/BoardConfig.mk b/BoardConfig.mk
index 0ae04ec..2edace4 100644
--- a/BoardConfig.mk
+++ b/BoardConfig.mk
@@ -97,7 +97,9 @@
 
 HAVE_ADRENO_SOURCE:= false
 
-OVERRIDE_RS_DRIVER:= libRSDriver_adreno.so
+# Bug: 36902991
+# Disable the GPU RS driver until we get a working drop.
+# OVERRIDE_RS_DRIVER:= libRSDriver_adreno.so
 
 # Enable dex-preoptimization to speed up first boot sequence
 ifeq ($(HOST_OS),linux)
diff --git a/device.mk b/device.mk
index 477299c..ba640ac 100644
--- a/device.mk
+++ b/device.mk
@@ -582,44 +582,6 @@
     $(call add-product-dex-preopt-module-config,wifi-service,--generate-mini-debug-info)
 endif
 
-# Get rid of dex preoptimization to save space within system.img at the one
-# time cost of dexing on first boot.  This list can be found by running:
-# grep odex $ANDROID_PRODUCT_OUT/installed-files.txt
-# Sorted by *.odex size
-BULLHEAD_DONT_DEXPREOPT_MODULES := \
-    BetterBug \
-    CloudPrint2 \
-    GoogleHindiIME \
-    GooglePinyinIME \
-    KoreanIME \
-    Photos \
-    PlayGames \
-    Videos \
-    Volta \
-    Wallet
-
-ifneq (,$(filter address,$(SANITIZE_TARGET)))
-# Blacklist more apps in ASANitized builds.
-BULLHEAD_DONT_DEXPREOPT_MODULES += \
-    Videos
-endif
-
-ifeq ($(NATIVE_COVERAGE),true)
-# Blacklist more apps in GCOV builds.
-BULLHEAD_DONT_DEXPREOPT_MODULES += \
-    Maps \
-    Velvet \
-    YouTube \
-    Photos \
-    Hangouts \
-    Phonesky \
-    Music2 \
-    Drive \
-    Chrome
-endif
-
-$(call add-product-dex-preopt-module-config,$(BULLHEAD_DONT_DEXPREOPT_MODULES),disable)
-
 # setup dalvik vm configs.
 $(call inherit-product, frameworks/native/build/phone-xhdpi-2048-dalvik-heap.mk)
 
diff --git a/sepolicy/device_domain_deprecated.te b/sepolicy/device_domain_deprecated.te
index bbe0b71..c74fc2b 100644
--- a/sepolicy/device_domain_deprecated.te
+++ b/sepolicy/device_domain_deprecated.te
@@ -8,6 +8,9 @@
 allow device_domain_deprecated system_file:dir r_dir_perms;
 allow device_domain_deprecated system_file:file r_file_perms;
 allow device_domain_deprecated system_file:lnk_file r_file_perms;
+allow device_domain_deprecated vendor_file_type:dir r_dir_perms;
+allow device_domain_deprecated vendor_file_type:file r_file_perms;
+allow device_domain_deprecated vendor_file_type:lnk_file r_file_perms;
 allow device_domain_deprecated system_data_file:file { getattr read };
 allow device_domain_deprecated system_data_file:lnk_file r_file_perms;
 allow device_domain_deprecated apk_data_file:dir { getattr search };
diff --git a/sepolicy/ims.te b/sepolicy/ims.te
index 75b6b54..6368c40 100644
--- a/sepolicy/ims.te
+++ b/sepolicy/ims.te
@@ -32,6 +32,7 @@
 
 # Runs /system/bin/ndc
 allow ims system_file:file rx_file_perms;
+allow ims vendor_file_type:file rx_file_perms;
 
 # address qualcomm proprietary binary denials
 allow ims self:netlink_socket create_socket_perms_no_ioctl;
diff --git a/sepolicy/netmgrd.te b/sepolicy/netmgrd.te
index b752060..aa6286f 100644
--- a/sepolicy/netmgrd.te
+++ b/sepolicy/netmgrd.te
@@ -26,6 +26,7 @@
 
 # Runs /system/bin/toolbox
 allow netmgrd system_file:file rx_file_perms;
+allow netmgrd vendor_file_type:file rx_file_perms;
 
 allow netmgrd self:netlink_socket create_socket_perms_no_ioctl;
 allow netmgrd self:netlink_route_socket nlmsg_write;