Service interruption via zero-length MBSSID element

Buffer over-read in Qualcomm WLAN Host Cmn firmware allows remote attackers to interrupt service using a zero-length MBSSID IE in a beacon. The beacon parser processes an MBSSID information element whose declared length is zero and reads beyond the associated buffer, causing a transient denial of service. No authentication or user interaction is required, and the reported consequence is temporary service interruption rather than data disclosure or modification.