The first is in the profile_tier_level structure, defined in section 7.3.3 of the H.265 spec:
And the second is in the VPS, defined in section F.7.3.2.1:
I verified both these fixes by generating a video stream and then consuming it with ffmpeg.