Local privilege escalation via faulty Binder cleanup

Use-after-free in Binder in Google Android kernels allows local users to escalate privileges through a malformed Binder transaction. A failed transaction with no processed objects supplies a zero failed_at offset, which cleanup misreads as an instruction to release every buffer object, freeing Binder nodes that later code accesses. A low-privileged local process can trigger the flaw without user interaction and gain kernel-level privileges.