tl;dr: A malformed WAP Push SMS triggers a NegativeArraySizeException in Android's `WapPushOverSms.decodeWapPdu()` (unchecked cast of a header length), crashing `com.android.phone` with zero user interaction, dropping calls including emergency calls, and persisting across reboots via carrier redelivery and queued retry — effectively bricking the phone for non-technical users. Affects Android 12–17; Google's October 2026 patch (for 14–17) fixes it by widening the caught exception and deleting the poison message rather than adding the obvious bounds check. Older unsupported versions remain vulnerable. PoC and source are public.