Local privilege escalation via mismatched WorkSource parceling

Local privilege escalation in Android 11, 12, 12L, and 13 allows local users to execute code in a privileged process via WorkSource parcels. WorkSource writes an empty non-null WorkChain list, but its parcel constructor reads the list only when the recorded size is positive, leaving a size value to corrupt later parcel fields. A low-privileged app can exploit the resulting object confusion without user interaction to execute code in a privileged context.