diff --git a/dp/wifi3.0/dp_tx.c b/dp/wifi3.0/dp_tx.c
index 4925a3e5c50b..2024e5202057 100644
--- a/dp/wifi3.0/dp_tx.c
+++ b/dp/wifi3.0/dp_tx.c
@@ -1881,8 +1881,9 @@ static bool dp_check_exc_metadata(struct cdp_tx_exception_metadata *tx_exc)
 {
 	bool invalid_tid = (tx_exc->tid > DP_MAX_TIDS && tx_exc->tid !=
 			    HTT_INVALID_TID);
-	bool invalid_encap_type = (tx_exc->tid > DP_MAX_TIDS && tx_exc->tid !=
-				   HTT_INVALID_TID);
+	bool invalid_encap_type =
+			(tx_exc->tx_encap_type > htt_cmn_pkt_num_types &&
+			 tx_exc->tx_encap_type != CDP_INVALID_TX_ENCAP_TYPE);
 	bool invalid_sec_type = (tx_exc->sec_type > cdp_num_sec_types &&
 				 tx_exc->sec_type != CDP_INVALID_SEC_TYPE);
 	bool invalid_cookie = (tx_exc->is_tx_sniffer == 1 &&
diff --git a/qdf/inc/qdf_types.h b/qdf/inc/qdf_types.h
index 653fe78fcb19..bc43c990dcfe 100644
--- a/qdf/inc/qdf_types.h
+++ b/qdf/inc/qdf_types.h
@@ -934,6 +934,22 @@ struct qdf_ipv6_addr {
  */
 QDF_STATUS qdf_ipv6_parse(const char *ipv6_str, struct qdf_ipv6_addr *out_addr);
 
+/**
+ * qdf_uint16_array_parse() - parse the given string as uint16 array
+ * @in_str: the input string to parse
+ * @out_array: the output uint16 array, populated on success
+ * @array_size: size of the array
+ * @out_size: size of the populated array
+ *
+ * This API is called to convert string (each value separated by
+ * a comma) into an uint16 array
+ *
+ * Return: QDF_STATUS
+ */
+
+QDF_STATUS qdf_uint16_array_parse(const char *in_str, uint16_t *out_array,
+				  qdf_size_t array_size, qdf_size_t *out_size);
+
 /**
  * qdf_uint8_array_parse() - parse the given string as uint8 array
  * @in_str: the input string to parse
diff --git a/qdf/src/qdf_types.c b/qdf/src/qdf_types.c
index 8f07989d9447..2abe831be287 100644
--- a/qdf/src/qdf_types.c
+++ b/qdf/src/qdf_types.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -612,6 +612,55 @@ QDF_STATUS qdf_ipv6_parse(const char *ipv6_str, struct qdf_ipv6_addr *out_addr)
 }
 qdf_export_symbol(qdf_ipv6_parse);
 
+QDF_STATUS qdf_uint16_array_parse(const char *in_str, uint16_t *out_array,
+				  qdf_size_t array_size, qdf_size_t *out_size)
+{
+	QDF_STATUS status;
+	bool negate;
+	qdf_size_t size = 0;
+	uint64_t value;
+
+	QDF_BUG(in_str);
+	if (!in_str)
+		return QDF_STATUS_E_INVAL;
+
+	QDF_BUG(out_array);
+	if (!out_array)
+		return QDF_STATUS_E_INVAL;
+
+	QDF_BUG(out_size);
+	if (!out_size)
+		return QDF_STATUS_E_INVAL;
+
+	while (size < array_size) {
+		status = __qdf_int_parse_lazy(&in_str, &value, &negate);
+		if (QDF_IS_STATUS_ERROR(status))
+			return status;
+
+		if ((uint16_t)value != value || negate)
+			return QDF_STATUS_E_RANGE;
+
+		in_str = qdf_str_left_trim(in_str);
+
+		switch (in_str[0]) {
+		case ',':
+			out_array[size++] = value;
+			in_str++;
+			break;
+		case '\0':
+			out_array[size++] = value;
+			*out_size = size;
+			return QDF_STATUS_SUCCESS;
+		default:
+			return QDF_STATUS_E_FAILURE;
+		}
+	}
+
+	return QDF_STATUS_E_FAILURE;
+}
+
+qdf_export_symbol(qdf_uint16_array_parse);
+
 QDF_STATUS qdf_uint8_array_parse(const char *in_str, uint8_t *out_array,
 				 qdf_size_t array_size, qdf_size_t *out_size)
 {