Privilege escalation via unchecked Opus retry result

Heap buffer overflow in Android 14 Bluetooth allows physically proximate attackers to escalate privileges through a crafted Opus frame. a2dp_vendor_opus_decoder_decode_packet retries a failed opus_decode call without checking the second negative return value, then converts it to an unsigned frame size that overflows the heap buffer. Exploitation requires a paired device, needs no user interaction, and can elevate execution privileges on the target.