See michalbednarski/IntentsLab#2 (comment) for description of bug.
This repositiory contains PoC for CVE-2017-0806, which is mismatch in GateKeeperResponse class.
michalbednarski/ReparcelBug
CVE-2017-0806 PoC (Android GateKeeperResponse writeToParcel/createFromParcel mismatch)
Java