Merge tag 'android-security-15.0.0_r10' into staging/lineage-22.2_merge-android-security-15.0.0_r10

Android Security 15.0.0 Release 10 (13793697)

# -----BEGIN PGP SIGNATURE-----
#
# iF0EABECAB0WIQRDQNE1cO+UXoOBCWTorT+BmrEOeAUCaLcitAAKCRDorT+BmrEO
# eDhlAJ9YmxAZ9M6XbdR//jkgfhVIsVeNfgCffe8T7siu1P8OZs2iDLIFYeiVu6Q=
# =05ez
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue Sep  2 20:00:36 2025 EEST
# gpg:                using DSA key 4340D13570EF945E83810964E8AD3F819AB10E78
# gpg: Good signature from "The Android Open Source Project <initial-contribution@android.com>" [ultimate]

* tag 'android-security-15.0.0_r10':
  Fix use after free in acl_arbiter

 Conflicts:
	system/stack/arbiter/acl_arbiter.cc

Change-Id: I62c8d51a9e3e5aed223b5b25af5cef17b21542f4

Author: mikeNG

system/stack/arbiter/acl_arbiter.cc

@@ -115,7 +115,7 @@ void AclArbiter::SendPacketToPeer(uint8_t tcb_idx, ::rust::Vec<uint8_t> buffer)
     if (stack::l2cap::get_interface().L2CA_SendFixedChnlData(L2CAP_ATT_CID, p_tcb->peer_bda,
                                                              p_buf) != tL2CAP_DW_RESULT::SUCCESS) {
       log::warn("Unable to send L2CAP data peer:{} fixed_cid:{} len:{}", p_tcb->peer_bda,
-                L2CAP_ATT_CID, p_buf->len);
+                L2CAP_ATT_CID, buffer.size());
     }
   } else {
     log::error("Dropping packet since connection no longer exists");