Local code execution via premature Parcel recycling

Logic error in Android 13 through 15 allows local users to execute arbitrary code through a malformed parcelled Bundle. During BaseBundle unparcelling, an exception can leave lazy values referencing Parcel data that the finally block recycles because a success-only assignment leaves the lazy-value count at zero. Exploitation needs no additional execution privileges or user interaction and enables local privilege escalation; the vendor bulletin separately labels the issue information disclosure.