diff --git a/exynos_omx/codecs/exynos_codecs/video/exynos5/mfc_v4l2/dec/src/ExynosVideoDecoder.c b/exynos_omx/codecs/exynos_codecs/video/exynos5/mfc_v4l2/dec/src/ExynosVideoDecoder.c
index a456a2b..48e152f 100644
--- a/exynos_omx/codecs/exynos_codecs/video/exynos5/mfc_v4l2/dec/src/ExynosVideoDecoder.c
+++ b/exynos_omx/codecs/exynos_codecs/video/exynos5/mfc_v4l2/dec/src/ExynosVideoDecoder.c
@@ -1483,7 +1483,9 @@
             buf.m.planes[i].bytesused = dataSize[i];
     }
 
-    if ((((OMX_BUFFERHEADERTYPE *)pPrivate)->nFlags & OMX_BUFFERFLAG_EOS) == OMX_BUFFERFLAG_EOS) {
+    // FIXME: figure out why |pPrivate| may be NULL.
+    if (pPrivate &&
+            (((OMX_BUFFERHEADERTYPE *)pPrivate)->nFlags & OMX_BUFFERFLAG_EOS) == OMX_BUFFERFLAG_EOS) {
         buf.flags |= V4L2_BUF_FLAG_LAST_FRAME;
         ALOGV("%s: OMX_BUFFERFLAG_EOS => LAST_FRAME: 0x%x", __func__,
               !!(buf.flags & V4L2_BUF_FLAG_LAST_FRAME));
diff --git a/exynos_omx/openmax/exynos_omx/component/video/dec/Exynos_OMX_VdecControl.c b/exynos_omx/openmax/exynos_omx/component/video/dec/Exynos_OMX_VdecControl.c
index 80c3b63..7d4b56b 100644
--- a/exynos_omx/openmax/exynos_omx/component/video/dec/Exynos_OMX_VdecControl.c
+++ b/exynos_omx/openmax/exynos_omx/component/video/dec/Exynos_OMX_VdecControl.c
@@ -1123,6 +1123,15 @@
                 (OMX_COLOR_FORMATTYPE)Exynos_OSAL_OMX2HalPixelFormat(portDefinition->format.video.eColorFormat);
             Exynos_OSAL_Log(EXYNOS_LOG_TRACE, "portDefinition->format.video.eColorFormat:0x%x", portDefinition->format.video.eColorFormat);
         }
+
+        // WORKAROUND provided by Google engineer
+        if (portIndex == OUTPUT_PORT_INDEX &&
+                (pExynosPort->bufferProcessType & BUFFER_COPY) == BUFFER_COPY) {
+            // Decoder actually uses width and height as stride and slice height for buffer copy.
+            // Changing only at getParam as the internal value may be used elsewhere
+            portDefinition->format.video.nStride = portDefinition->format.video.nFrameWidth;
+            portDefinition->format.video.nSliceHeight = portDefinition->format.video.nFrameHeight;
+        }
     }
         break;
 #endif
diff --git a/exynos_omx/openmax/exynos_omx/osal/Exynos_OSAL_Android.cpp b/exynos_omx/openmax/exynos_omx/osal/Exynos_OSAL_Android.cpp
index d4e24d3..b128aaf 100644
--- a/exynos_omx/openmax/exynos_omx/osal/Exynos_OSAL_Android.cpp
+++ b/exynos_omx/openmax/exynos_omx/osal/Exynos_OSAL_Android.cpp
@@ -696,6 +696,12 @@
             pExynosPort->bufferProcessType = BUFFER_SHARE;
             pExynosPort->portDefinition.format.video.eColorFormat = (OMX_COLOR_FORMATTYPE)OMX_SEC_COLOR_FormatNV12Tiled;
             Exynos_OSAL_Log(EXYNOS_LOG_TRACE, "OMX_IndexParamEnableAndroidBuffers & bufferProcessType change to BUFFER_SHARE");
+        } else if ((portIndex == OUTPUT_PORT_INDEX) &&
+            (pExynosPort->bStoreMetaData == OMX_FALSE && pExynosPort->bIsANBEnabled == OMX_FALSE) &&
+            pExynosPort->bufferProcessType == BUFFER_SHARE) {
+            pExynosPort->bufferProcessType = (EXYNOS_OMX_BUFFERPROCESS_TYPE)(BUFFER_COPY | BUFFER_ANBSHARE);
+            pExynosPort->portDefinition.format.video.eColorFormat = OMX_COLOR_FormatYUV420Planar;
+            Exynos_OSAL_Log(EXYNOS_LOG_TRACE, "No OMX_IndexParamEnableAndroidBuffers => reset bufferProcessType");
         }
     }
         break;
@@ -789,6 +795,12 @@
                 pExynosPort->bufferProcessType = BUFFER_SHARE;
                 pExynosPort->portDefinition.format.video.eColorFormat = (OMX_COLOR_FORMATTYPE)OMX_SEC_COLOR_FormatNV12Tiled;
                 Exynos_OSAL_Log(EXYNOS_LOG_TRACE, "OMX_IndexParamStoreMetaDataBuffer & bufferProcessType change to BUFFER_SHARE");
+            } else if ((portIndex == OUTPUT_PORT_INDEX) &&
+                (pExynosPort->bStoreMetaData == OMX_FALSE && pExynosPort->bIsANBEnabled == OMX_FALSE) &&
+                pExynosPort->bufferProcessType == BUFFER_SHARE) {
+                pExynosPort->bufferProcessType = (EXYNOS_OMX_BUFFERPROCESS_TYPE)(BUFFER_COPY | BUFFER_ANBSHARE);
+                pExynosPort->portDefinition.format.video.eColorFormat = OMX_COLOR_FormatYUV420Planar;
+                Exynos_OSAL_Log(EXYNOS_LOG_TRACE, "No OMX_IndexParamStoreMetaDataBuffer => reset bufferProcessType");
             }
 
         }
diff --git a/libcamera2/ExynosCameraHWInterface2.cpp b/libcamera2/ExynosCameraHWInterface2.cpp
index 8fce907..fa6c8d3 100644
--- a/libcamera2/ExynosCameraHWInterface2.cpp
+++ b/libcamera2/ExynosCameraHWInterface2.cpp
@@ -615,10 +615,15 @@
     ALOGV("DEBUG(%s): frameCnt(%d)", __FUNCTION__, shot_ext->shot.ctl.request.frameCount);
 
     for (i = 0 ; i < NUM_MAX_REQUEST_MGR_ENTRY ; i++) {
-        if((entries[i].internal_shot.shot.ctl.request.frameCount == shot_ext->shot.ctl.request.frameCount)
-            && (entries[i].status == CAPTURED)){
-            entries[i].status = METADONE;
-            break;
+        if (entries[i].internal_shot.shot.ctl.request.frameCount
+                == shot_ext->shot.ctl.request.frameCount) {
+            if (entries[i].status == CAPTURED) {
+                entries[i].status = METADONE;
+                break;
+            }
+            if (entries[i].status == METADONE) {
+                return;
+            }
         }
     }
 
@@ -861,9 +866,10 @@
     return &currentEntry->internal_shot;
 }
 
-int     RequestManager::FindFrameCnt(struct camera2_shot_ext * shot_ext)
+int     RequestManager::FindFrameCnt(struct camera2_shot_ext * shot_ext, bool drain)
 {
     Mutex::Autolock lock(m_requestMutex);
+    Mutex::Autolock lock2(m_numOfEntriesLock);
     int i;
 
     if (m_numOfEntries == 0) {
@@ -879,6 +885,9 @@
             entries[i].status = CAPTURED;
             return entries[i].internal_shot.shot.ctl.request.frameCount;
         }
+        if (drain && (entries[i].status >= CAPTURED)) {
+            return entries[i].internal_shot.shot.ctl.request.frameCount;
+        }
         CAM_LOGE("ERR(%s): frameCount(%d), index(%d), status(%d)", __FUNCTION__, shot_ext->shot.ctl.request.frameCount, i, entries[i].status);
 
     }
@@ -1052,7 +1061,7 @@
         m_ctlInfo.flash.m_afFlashDoneFlg= false;
         m_ctlInfo.flash.m_flashEnableFlg = false;
         m_ctlInfo.flash.m_flashFrameCount = 0;
-        m_ctlInfo.flash.m_flashCnt = 0;
+        m_ctlInfo.flash.m_flashCnt = IS_FLASH_STATE_NONE;
         m_ctlInfo.flash.m_flashTimeOut = 0;
         m_ctlInfo.flash.m_flashDecisionResult = false;
         m_ctlInfo.flash.m_flashTorchMode = false;
@@ -2957,7 +2966,7 @@
         shot_ext->request_scc = 0;
         shot_ext->request_scp = 0;
         m_ctlInfo.flash.m_flashEnableFlg = false;
-        m_ctlInfo.flash.m_flashCnt = 0;
+        m_ctlInfo.flash.m_flashCnt = IS_FLASH_STATE_NONE;
         m_ctlInfo.flash.m_afFlashDoneFlg= false;
         break;
     case IS_FLASH_STATE_NONE:
@@ -3154,7 +3163,7 @@
             matchedFrameCnt = m_ctlInfo.flash.m_flashFrameCount;
             ALOGV("Skip frame, request is fixed at %d", matchedFrameCnt);
         } else {
-            matchedFrameCnt = m_requestManager->FindFrameCnt(shot_ext);
+            matchedFrameCnt = m_requestManager->FindFrameCnt(shot_ext, m_isRequestQueueNull);
         }
 
         if (matchedFrameCnt == -1 && m_vdisBubbleCnt > 0) {
@@ -3231,7 +3240,7 @@
                         m_ctlInfo.flash.m_flashEnableFlg = false;
                         m_ctlInfo.flash.m_afFlashDoneFlg = false;
                         m_ctlInfo.flash.m_flashDecisionResult = false;
-                        m_ctlInfo.flash.m_flashCnt = 0;
+                        m_ctlInfo.flash.m_flashCnt = IS_FLASH_STATE_NONE;
                     }
                     m_ctlInfo.af.m_afTriggerTimeOut = 1;
                 }
@@ -3367,7 +3376,7 @@
                 if (!m_ctlInfo.flash.m_flashDecisionResult) {
                     m_ctlInfo.flash.m_flashEnableFlg = false;
                     m_ctlInfo.flash.m_afFlashDoneFlg = false;
-                    m_ctlInfo.flash.m_flashCnt = 0;
+                    m_ctlInfo.flash.m_flashCnt = IS_FLASH_STATE_NONE;
                 } else if ((m_ctlInfo.flash.m_flashCnt == IS_FLASH_STATE_AUTO_DONE) ||
                                           (m_ctlInfo.flash.m_flashCnt == IS_FLASH_STATE_AUTO_OFF)) {
                     ALOGD("(%s): [Flash] Flash capture start : skip request scc 1#####", __FUNCTION__);
@@ -3381,7 +3390,7 @@
                     shot_ext->shot.ctl.aa.aeflashMode = AA_FLASHMODE_OFF;
                     m_ctlInfo.flash.m_flashEnableFlg = false;
                     m_ctlInfo.flash.m_afFlashDoneFlg= false;
-                    m_ctlInfo.flash.m_flashCnt = 0;
+                    m_ctlInfo.flash.m_flashCnt = IS_FLASH_STATE_NONE;
                 }
             } else if (shot_ext->shot.ctl.aa.captureIntent == AA_CAPTURE_INTENT_STILL_CAPTURE) {
                 m_ctlInfo.flash.m_flashDecisionResult = false;
@@ -3408,8 +3417,14 @@
                 shot_ext->request_scc = 0;
                 m_reprocessingFrameCnt = shot_ext->shot.ctl.request.frameCount;
                 m_ctlInfo.flash.m_flashDecisionResult = false;
-                memcpy(&m_jpegMetadata, (void*)(m_requestManager->GetInternalShotExtByFrameCnt(m_reprocessingFrameCnt)),
-                    sizeof(struct camera2_shot_ext));
+                void *shot = m_requestManager->GetInternalShotExtByFrameCnt(m_reprocessingFrameCnt);
+                if (!shot) { // m_isRequestQueueNull reuse current
+                    ALOGD("(%s): isReprocessing: "
+                        "m_reprocessingFrameCnt missing, using shot_ext",
+                        __FUNCTION__);
+                    shot = shot_ext;
+                }
+                memcpy(&m_jpegMetadata, shot, sizeof(struct camera2_shot_ext));
                 m_streamThreads[1]->SetSignal(SIGNAL_STREAM_REPROCESSING_START);
                 m_ctlInfo.flash.m_flashEnableFlg = false;
             }
@@ -3512,11 +3527,18 @@
             if (shot_ext->request_scc) {
                 ALOGV("send SIGNAL_STREAM_DATA_COMING (SCC)");
                 if (shot_ext->shot.ctl.request.outputStreams[0] & STREAM_MASK_JPEG) {
-                    if (m_ctlInfo.flash.m_flashCnt < IS_FLASH_STATE_CAPTURE)
-                        memcpy(&m_jpegMetadata, (void*)(m_requestManager->GetInternalShotExtByFrameCnt(shot_ext->shot.ctl.request.frameCount)),
-                            sizeof(struct camera2_shot_ext));
-                    else
-                        memcpy(&m_jpegMetadata, (void*)shot_ext, sizeof(struct camera2_shot_ext));
+                    void *shot = shot_ext;
+                    if (m_ctlInfo.flash.m_flashCnt < IS_FLASH_STATE_CAPTURE) {
+                        shot = m_requestManager->GetInternalShotExtByFrameCnt(
+                            shot_ext->shot.ctl.request.frameCount);
+                        if (!shot) { // m_isRequestQueueNull reuse current
+                            ALOGD("(%s): request_scc: "
+                                "m_reprocessingFrameCnt missing, using shot_ext",
+                                __FUNCTION__);
+                            shot = shot_ext;
+                        }
+                    }
+                    memcpy(&m_jpegMetadata, shot, sizeof(struct camera2_shot_ext));
                 }
                 m_streamThreads[1]->SetSignal(SIGNAL_STREAM_DATA_COMING);
             }
diff --git a/libcamera2/ExynosCameraHWInterface2.h b/libcamera2/ExynosCameraHWInterface2.h
index a8e3348..927eace 100644
--- a/libcamera2/ExynosCameraHWInterface2.h
+++ b/libcamera2/ExynosCameraHWInterface2.h
@@ -283,7 +283,7 @@
     uint8_t  GetOutputStream(int index);
     camera2_shot_ext *  GetInternalShotExtByFrameCnt(int frameCnt);
     camera2_shot_ext *  GetInternalShotExt(int index);
-    int     FindFrameCnt(struct camera2_shot_ext * shot_ext);
+    int     FindFrameCnt(struct camera2_shot_ext * shot_ext, bool drain);
     bool    IsVdisEnable(void);
     int     FindEntryIndexByFrameCnt(int frameCnt);
     void    Dump(void);
diff --git a/libcamera2/ExynosJpegEncoderForCamera.cpp b/libcamera2/ExynosJpegEncoderForCamera.cpp
index 9eb924f..14d73af 100644
--- a/libcamera2/ExynosJpegEncoderForCamera.cpp
+++ b/libcamera2/ExynosJpegEncoderForCamera.cpp
@@ -17,6 +17,7 @@
 
 #define LOG_TAG "ExynosJpegForCamera"
 #include <utils/Log.h>
+#include <string.h>
 
 #include "ExynosJpegEncoderForCamera.h"
 
diff --git a/libgscaler/exynos_gsc_utils.h b/libgscaler/exynos_gsc_utils.h
index 8c0217f..8e5c49d 100644
--- a/libgscaler/exynos_gsc_utils.h
+++ b/libgscaler/exynos_gsc_utils.h
@@ -128,6 +128,7 @@
     void            *op_mutex;
     void            *obj_mutex[NUM_OF_GSC_HW];
     void            *cur_obj_mutex;
+    bool             destroy_cur_obj_mutex;
     bool             flag_local_path;
     bool             flag_exclusive_open;
     struct media_device *media0;
diff --git a/libgscaler/exynos_gscaler.c b/libgscaler/exynos_gscaler.c
index 360812b..0e7bb77 100644
--- a/libgscaler/exynos_gscaler.c
+++ b/libgscaler/exynos_gscaler.c
@@ -561,9 +561,14 @@
                     continue;
                 }
 
-                if (gsc_handle->cur_obj_mutex)
+                /* Trade temporary object for one in the pool */
+                if (gsc_handle->cur_obj_mutex) {
                     exynos_mutex_unlock(gsc_handle->cur_obj_mutex);
+                    if (gsc_handle->destroy_cur_obj_mutex)
+                        exynos_mutex_destroy(gsc_handle->cur_obj_mutex);
+                }
 
+                gsc_handle->destroy_cur_obj_mutex = false;
                 gsc_handle->cur_obj_mutex = gsc_handle->obj_mutex[i];
 
                 flag_find_new_gsc = true;
@@ -729,6 +734,7 @@
         gsc_handle->obj_mutex[i] = NULL;
 
     gsc_handle->cur_obj_mutex = NULL;
+    gsc_handle->destroy_cur_obj_mutex = false;
     gsc_handle->flag_local_path = false;
     gsc_handle->flag_exclusive_open = false;
 
@@ -813,6 +819,7 @@
     gsc_handle->gsc_fd = -1;
     gsc_handle->op_mutex = NULL;
     gsc_handle->cur_obj_mutex = NULL;
+    gsc_handle->destroy_cur_obj_mutex = true;
 
     sprintf(mutex_name, "%sObject%d", LOG_TAG, dev_num);
     gsc_handle->cur_obj_mutex = exynos_mutex_create(EXYNOS_MUTEX_TYPE_SHARED, mutex_name);
@@ -908,6 +915,7 @@
         gsc_handle->obj_mutex[i] = NULL;
 
     gsc_handle->cur_obj_mutex = NULL;
+    gsc_handle->destroy_cur_obj_mutex = false;
     gsc_handle->flag_local_path = false;
     gsc_handle->flag_exclusive_open = true;
 
@@ -928,6 +936,7 @@
         ALOGE("%s::exynos_mutex_create(%s) fail", __func__, mutex_name);
         goto err;
     }
+    gsc_handle->destroy_cur_obj_mutex = true;
 
     do {
         if (exynos_mutex_trylock(gsc_handle->cur_obj_mutex) == true) {
@@ -965,8 +974,11 @@
     if (gsc_handle) {
         m_exynos_gsc_destroy(gsc_handle);
 
-        if (gsc_handle->cur_obj_mutex)
+        if (gsc_handle->cur_obj_mutex) {
             exynos_mutex_unlock(gsc_handle->cur_obj_mutex);
+            if (gsc_handle->destroy_cur_obj_mutex)
+                exynos_mutex_destroy(gsc_handle->cur_obj_mutex);
+        }
 
         for (i = 0; i < NUM_OF_GSC_HW; i++) {
             if ((gsc_handle->obj_mutex[i] != NULL) &&
@@ -1023,6 +1035,9 @@
         }
     }
 
+    if (gsc_handle->destroy_cur_obj_mutex)
+        exynos_mutex_destroy(gsc_handle->cur_obj_mutex);
+
     exynos_mutex_unlock(gsc_handle->op_mutex);
 
     if (exynos_mutex_destroy(gsc_handle->op_mutex) == false)
diff --git a/libkeymaster/keymaster_mobicore.cpp b/libkeymaster/keymaster_mobicore.cpp
index 7d11a18..9fa10aa 100644
--- a/libkeymaster/keymaster_mobicore.cpp
+++ b/libkeymaster/keymaster_mobicore.cpp
@@ -20,7 +20,7 @@
 #include <stdint.h>
 
 #include <hardware/hardware.h>
-#include <hardware/keymaster.h>
+#include <hardware/keymaster0.h>
 
 #include <openssl/evp.h>
 #include <openssl/bio.h>
@@ -66,7 +66,7 @@
 };
 typedef UniquePtr<RSA, RSA_Delete> Unique_RSA;
 
-typedef UniquePtr<keymaster_device_t> Unique_keymaster_device_t;
+typedef UniquePtr<keymaster0_device_t> Unique_keymaster_device_t;
 
 /**
  * Many OpenSSL APIs take ownership of an argument on success but don't free the argument
@@ -92,7 +92,7 @@
     ERR_remove_state(0);
 }
 
-static int exynos_km_generate_keypair(const keymaster_device_t* dev,
+static int exynos_km_generate_keypair(const keymaster0_device_t* dev,
         const keymaster_keypair_t key_type, const void* key_params,
         uint8_t** keyBlob, size_t* keyBlobLength) {
     teeResult_t ret = TEE_ERR_NONE;
@@ -133,7 +133,7 @@
     return 0;
 }
 
-static int exynos_km_import_keypair(const keymaster_device_t* dev,
+static int exynos_km_import_keypair(const keymaster0_device_t* dev,
         const uint8_t* key, const size_t key_length,
         uint8_t** key_blob, size_t* key_blob_length) {
     uint8_t kbuf[RSA_KEY_BUFFER_SIZE];
@@ -229,7 +229,7 @@
     return 0;
 }
 
-static int exynos_km_get_keypair_public(const struct keymaster_device* dev,
+static int exynos_km_get_keypair_public(const keymaster0_device_t* dev,
         const uint8_t* key_blob, const size_t key_blob_length,
         uint8_t** x509_data, size_t* x509_data_length) {
     uint32_t bin_mod_len;
@@ -328,7 +328,7 @@
     return 0;
 }
 
-static int exynos_km_sign_data(const keymaster_device_t* dev,
+static int exynos_km_sign_data(const keymaster0_device_t* dev,
         const void* params,
         const uint8_t* keyBlob, const size_t keyBlobLength,
         const uint8_t* data, const size_t dataLength,
@@ -376,7 +376,7 @@
     return 0;
 }
 
-static int exynos_km_verify_data(const keymaster_device_t* dev,
+static int exynos_km_verify_data(const keymaster0_device_t* dev,
         const void* params,
         const uint8_t* keyBlob, const size_t keyBlobLength,
         const uint8_t* signedData, const size_t signedDataLength,
@@ -431,7 +431,7 @@
     if (strcmp(name, KEYSTORE_KEYMASTER) != 0)
         return -EINVAL;
 
-    Unique_keymaster_device_t dev(new keymaster_device_t);
+    Unique_keymaster_device_t dev(new keymaster0_device_t);
     if (dev.get() == NULL)
         return -ENOMEM;
 
diff --git a/mobicore/common/LogWrapper/log.h b/mobicore/common/LogWrapper/log.h
index 2ffc0b2..041793c 100644
--- a/mobicore/common/LogWrapper/log.h
+++ b/mobicore/common/LogWrapper/log.h
@@ -36,6 +36,7 @@
 
 #include <unistd.h>
 #include <stdio.h>
+#include <string.h>
 #include <android/log.h>
 
 /** LOG_I(fmt, args...)
diff --git a/mobicore/daemon/Kernel/CKMod.cpp b/mobicore/daemon/Kernel/CKMod.cpp
index 030089d..30210db 100644
--- a/mobicore/daemon/Kernel/CKMod.cpp
+++ b/mobicore/daemon/Kernel/CKMod.cpp
@@ -31,6 +31,7 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <cstdlib>
+#include <cstring>
 
 #include <fcntl.h>
 #include <sys/mman.h>