diff --git a/libvehiclenetwork/native/IVehicleNetwork.cpp b/libvehiclenetwork/native/IVehicleNetwork.cpp
index eb126cd..f8ba297 100644
--- a/libvehiclenetwork/native/IVehicleNetwork.cpp
+++ b/libvehiclenetwork/native/IVehicleNetwork.cpp
@@ -77,6 +77,10 @@
                 return holder;
             }
             int32_t size = reply.readInt32();
+            if (size < 0) {
+                ALOGE("listProperties, bad blob size %d", size);
+                return holder;
+            }
             status = reply.readBlob(size, blob.blob);
             if (status != NO_ERROR) {
                 ALOGE("listProperties, cannot read blob %d", status);
@@ -400,6 +404,10 @@
             ReadableBlobHolder blob(new Parcel::ReadableBlob());
             ASSERT_OR_HANDLE_NO_MEMORY(blob.blob, return NO_MEMORY);
             int32_t size = data.readInt32();
+            if (size < 0) {
+                ALOGE("injectEvent:service, bad blob size %d", size);
+                return BAD_VALUE;
+            }
             r = data.readBlob(size, blob.blob);
             if (r != NO_ERROR) {
                 ALOGE("injectEvent:service, cannot read blob");
diff --git a/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp b/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp
index 1085a57..91e00b2 100644
--- a/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp
+++ b/libvehiclenetwork/native/IVehicleNetworkHalMock.cpp
@@ -69,6 +69,10 @@
                 return holder;
             }
             int32_t size = reply.readInt32();
+            if (size < 0) {
+                ALOGE("listProperties, bad blob size %d", size);
+                return holder;
+            }
             status = reply.readBlob(size, blob.blob);
             if (status != NO_ERROR) {
                 ALOGE("listProperties, cannot read blob %d", status);
@@ -202,6 +206,10 @@
             ReadableBlobHolder blob(new Parcel::ReadableBlob());
             ASSERT_OR_HANDLE_NO_MEMORY(blob.blob, return NO_MEMORY);
             int32_t size = data.readInt32();
+            if (size < 0) {
+                ALOGE("setProperty:service, bad blob size %d", size);
+                return BAD_VALUE;
+            }
             r = data.readBlob(size, blob.blob);
             if (r != NO_ERROR) {
                 ALOGE("setProperty:service, cannot read blob");
diff --git a/libvehiclenetwork/native/IVehicleNetworkListener.cpp b/libvehiclenetwork/native/IVehicleNetworkListener.cpp
index cd79515..565c51d 100644
--- a/libvehiclenetwork/native/IVehicleNetworkListener.cpp
+++ b/libvehiclenetwork/native/IVehicleNetworkListener.cpp
@@ -112,6 +112,10 @@
             ReadableBlobHolder blob(new Parcel::ReadableBlob());
             ASSERT_OR_HANDLE_NO_MEMORY(blob.blob, return NO_MEMORY);
             int32_t size = data.readInt32();
+            if (size < 0) {
+                ALOGE("onEvents: bad blob size %d", size);
+                return BAD_VALUE;
+            }
             r = data.readBlob(size, blob.blob);
             if (r != NO_ERROR) {
                 ALOGE("onEvents: cannot read blob");
diff --git a/libvehiclenetwork/native/VehicleNetworkProtoUtil.cpp b/libvehiclenetwork/native/VehicleNetworkProtoUtil.cpp
index fc283ea..c79164c 100644
--- a/libvehiclenetwork/native/VehicleNetworkProtoUtil.cpp
+++ b/libvehiclenetwork/native/VehicleNetworkProtoUtil.cpp
@@ -626,6 +626,10 @@
     ReadableBlobHolder blob(new Parcel::ReadableBlob());
     ASSERT_OR_HANDLE_NO_MEMORY(blob.blob, return NO_MEMORY);
     int32_t size = parcel.readInt32();
+    if (size < 0) {
+        ALOGE("readFromParcel, bad blob size %d", size);
+        return BAD_VALUE;
+    }
     status_t status = parcel.readBlob(size, blob.blob);
     if (status != NO_ERROR) {
         ALOGE("readFromParcel, cannot read blob");
diff --git a/service/src/com/android/car/hal/PowerHalService.java b/service/src/com/android/car/hal/PowerHalService.java
index 86bf78e..580e7a7 100644
--- a/service/src/com/android/car/hal/PowerHalService.java
+++ b/service/src/com/android/car/hal/PowerHalService.java
@@ -278,7 +278,8 @@
     }
 
     @Override
-    public List<VehiclePropConfig> takeSupportedProperties(List<VehiclePropConfig> allProperties) {
+    public synchronized List<VehiclePropConfig> takeSupportedProperties(
+            List<VehiclePropConfig> allProperties) {
         for (VehiclePropConfig config : allProperties) {
             switch (config.getProp()) {
                 case VehicleNetworkConsts.VEHICLE_PROPERTY_AP_POWER_STATE:
diff --git a/service/src/com/android/car/pm/CarPackageManagerService.java b/service/src/com/android/car/pm/CarPackageManagerService.java
index a13bf4d..9d02973 100644
--- a/service/src/com/android/car/pm/CarPackageManagerService.java
+++ b/service/src/com/android/car/pm/CarPackageManagerService.java
@@ -277,6 +277,11 @@
         }
         synchronized (this) {
             mHandler.requestRelease();
+            // wait for release do be done. This guarantees that init is done.
+            try {
+                wait();
+            } catch (InterruptedException e) {
+            }
             mSystemWhitelists.clear();
             mClientPolicies.clear();
             if (mProxies != null) {
@@ -296,14 +301,24 @@
     private void doHandleInit() {
         startAppBlockingPolicies();
         generateSystemWhitelists();
-        mSensorService.registerOrUpdateSensorListener(
-                CarSensorManager.SENSOR_TYPE_DRIVING_STATUS, 0, mDrivingStateListener);
+        try {
+            mSensorService.registerOrUpdateSensorListener(
+                    CarSensorManager.SENSOR_TYPE_DRIVING_STATUS, 0, mDrivingStateListener);
+        } catch (IllegalArgumentException e) {
+            // can happen while mocking is going on while init is still done.
+            Log.w(CarLog.TAG_PACKAGE, "sensor subscription failed", e);
+            return;
+        }
         mDrivingStateListener.resetState();
         mSystemActivityMonitoringService.registerActivityLaunchListener(
                 mActivityLaunchListener);
         blockTopActivitiesIfNecessary();
     }
 
+    private synchronized void doHandleRelease() {
+        notifyAll();
+    }
+
     private void wakeupClientsWaitingForPolicySetitngLocked() {
         for (CarAppBlockingPolicy waitingPolicy : mWaitingPolicies) {
             synchronized (waitingPolicy) {
@@ -670,6 +685,7 @@
         private final int MSG_INIT = 0;
         private final int MSG_SET_POLICY = 1;
         private final int MSG_UPDATE_POLICY = 2;
+        private final int MSG_RELEASE = 3;
 
         private PackageHandler(Looper looper) {
             super(looper);
@@ -684,6 +700,8 @@
             removeMessages(MSG_INIT);
             removeMessages(MSG_SET_POLICY);
             removeMessages(MSG_UPDATE_POLICY);
+            Message msg = obtainMessage(MSG_RELEASE);
+            sendMessage(msg);
         }
 
         private void requestPolicySetting() {
@@ -712,6 +730,9 @@
                             (Pair<String, CarAppBlockingPolicy>) msg.obj;
                     doUpdatePolicy(pair.first, pair.second, msg.arg1);
                     break;
+                case MSG_RELEASE:
+                    doHandleRelease();
+                    break;
             }
         }
     }