Local privilege escalation via unchecked Opus decode retry

Heap buffer overflow in Google Android 14, 15, 16, 16-qpr2, and 17 allows local users to escalate privileges via an A2DP Opus packet. The a2dp_vendor_opus_decoder_decode_packet function retries a failed opus_decode call without rechecking its negative return value, then converts that value to unsigned when calculating frame length and writes beyond the heap buffer. Exploitation requires local access to the Bluetooth audio path, needs no additional execution privileges or user interaction, and grants higher privileges through memory corruption.