[Xiaomi Redmi Note 3 [Snapdragon] ROMs, Kernels, Re] gothicVI:
Hi, may I ask where you did get the backport of the latest security patches? When I was building for thea today build.prop was as follows:

# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=MOB31T
ro.build.display.id=cm_thea-userdebug 6.0.1 MOB31T 5d20351f62 test-keys
ro.build.version.incremental=5d20351f62
ro.build.version.sdk=23
ro.build.version.preview_sdk=0
ro.build.version.codename=REL
ro.build.version.all_codenames=REL
ro.build.version.release=6.0.1
[COLOR="red"]ro.build.version.security_patch=2017-04-01[/COLOR]
ro.build.version.base_os=
[COLOR="red"]ro.build.date=Mi 19. Apr 09:34:55 CEST 2017[/COLOR]
ro.build.date.utc=1492587295
ro.build.type=userdebug
ro.build.user=gothicvi
ro.build.host=KLEINEINSTEIN
ro.build.tags=test-keys
ro.build.flavor=cm_thea-userdebug
ro.product.brand=motorola
ro.product.name=cm_thea
ro.product.board=MSM8226
# ro.product.cpu.abi and ro.product.cpu.abi2 are obsolete,
# use ro.product.cpu.abilist instead.
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.cpu.abilist=armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=
ro.product.manufacturer=motorola
ro.product.locale=en-US
ro.wifi.channels=
ro.board.platform=msm8226
ro.build.characteristics=default
ro.cm.device=thea
# end build properties
#
# from device/motorola/msm8226-common/system.prop
#

# Art
dalvik.vm.dex2oat-flags=--no-watch-dog

# Audio
audio.offload.disable=0
audio.offload.pcm.16bit.enable=false
audio.offload.pcm.24bit.enable=false
audio.offload.buffer.size.kb=32
audio.offload.gapless.enabled=true
audio.offload.video=false

persist.audio.calfile0=/etc/Bluetooth_cal.acdb
persist.audio.calfile1=/etc/General_cal.acdb
persist.audio.calfile2=/etc/Global_cal.acdb
persist.audio.calfile3=/etc/Handset_cal.acdb
persist.audio.calfile4=/etc/Hdmi_cal.acdb
persist.audio.calfile5=/etc/Headset_cal.acdb
persist.audio.calfile6=/etc/Speaker_cal.acdb

persist.audio.fluence.voicecall=true
ro.qc.sdk.audio.fluencetype=fluence
ro.qc.sdk.audio.ssr=false

use.voice.path.for.pcm.voip=true

# Bluetooth
qcom.bt.le_dev_pwr_class=1
ro.qualcomm.bluetooth.opp=true
ro.qualcomm.bluetooth.hfp=true
ro.qualcomm.bluetooth.hsp=true
ro.qualcomm.bluetooth.pbap=true
ro.qualcomm.bluetooth.ftp=true
ro.qualcomm.bluetooth.nap=true
ro.qualcomm.bluetooth.map=true
ro.bluetooth.sap=true
ro.bluetooth.dun=true
ro.bluetooth.hfp.ver=1.6
ro.qualcomm.bt.hci_transport=smd

# Display
persist.hwc.mdpcomp.enable=true
ro.opengles.version=196608
ro.sf.lcd_density=320

# GPS
ro.gps.agps_provider=1
ro.qc.sdk.izat.premium_enabled=1
ro.qc.sdk.izat.service_mask=0x5
persist.gps.qc_nlp_in_use=1
persist.loc.nlp_name=com.qualcomm.services.location

# NITZ
persist.radio.nitz_plmn=
persist.radio.nitz_lons_0=
persist.radio.nitz_lons_1=
persist.radio.nitz_lons_2=
persist.radio.nitz_lons_3=
persist.radio.nitz_sons_0=
persist.radio.nitz_sons_1=
persist.radio.nitz_sons_2=
persist.radio.nitz_sons_3=

# Qualcomm
persist.timed.enable=true
ro.qualcomm.cabl=0
net.early.sockets=0
vidc.debug.level=1
ro.vendor.extension_library=/system/vendor/lib/libqti-perfd-client.so

# Radio
persist.data.qmi.adb_logmask=0
persist.radio.no_wait_for_card=1
persist.radio.apm_sim_not_pwdn=1
persist.radio.dfr_mode_set=1
persist.radio.relay_oprt_change=1
persist.radio.msgtunnel.start=false
rild.libpath=/system/vendor/lib/libril-qc-qmi-1.so
rild.libargs=-d /dev/smd0
ro.use_data_netmgrd=true

# Scheduler
sys.io.scheduler=bfq

# Subsystem
persist.sys.ssr.enable_debug=0

# Wifi
persist.sys.qc.sub.rdump.on=1
ro.disableWifiApFirmwareReload=true

#
# from device/motorola/thea/system.prop
#
# system.prop for thea

# audio
ro.audio.monitorRotation=1
ro.config.vc_call_vol_steps=8

#
# ADDITIONAL_BUILD_PROPERTIES
#
keyguard.no_require_sim=true
ro.carrier=unknown
dalvik.vm.heapstartsize=8m
dalvik.vm.heapgrowthlimit=96m
dalvik.vm.heapsize=256m
dalvik.vm.heaptargetutilization=0.75
dalvik.vm.heapminfree=2m
dalvik.vm.heapmaxfree=8m
ro.com.google.clientidbase=android-motorola
ro.build.selinux=1
ro.config.notification_sound=Argon.ogg
ro.config.alarm_alert=Helium.ogg
persist.sys.dun.override=0
ro.cm.build.version.plat.sdk=6
ro.cm.build.version.plat.rev=0
media.sf.omx-plugin=libffmpeg_omx.so
media.sf.extractor-plugin=libffmpeg_extractor.so
ro.cm.version=13.0-20170419-UNOFFICIAL-thea
ro.cm.releasetype=UNOFFICIAL
ro.modversion=13.0-20170419-UNOFFICIAL-thea
ro.cmlegal.url=https://lineageos.org/legal
ro.cm.display.version=13.0-20170419-UNOFFICIAL-thea
ro.config.ringtone=Orion.ogg
persist.sys.dalvik.vm.lib.2=libart.so
dalvik.vm.isa.arm.variant=krait
dalvik.vm.isa.arm.features=default
dalvik.vm.lockprof.threshold=500
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
ro.expect.recovery_id=0xdcb9949bf2f34fe21f4ae8620059e62f23238c68000000000000000000000000

Do you think a clean build solves this?