Crash in /system/bin/servicemanager, HWAddressSanitizer: tag-mismatch on address 0x0047d0091f80 at pc 0x0070cd6a11e4 READ of size 8 at 0x0047d0091f80 tags: d3/5b (ptr/mem) in thread T0

In ipcSetDataReference of Parcel.cpp, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.