Screen capture via cross-user policy overwrite

Protection mechanism failure in Android 13 Framework allows local users to capture screens blocked by device policy without interaction. DevicePolicyManagerService stored the device-wide screen-capture restriction in one integer, so starting a non-managed user replaced an existing administrator policy with that user's default state. Exploitation requires low-privileged local access and an active screen-capture restriction; the bypass exposes screen contents but does not itself establish arbitrary code execution.