On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 router advertisement offloading.
https://support.apple.com/en-us/HT208113
https://support.apple.com/en-us/HT208112