[dos] Android – ashmem Readonly Bypasses via remap_file_pages() and ASHMEM_UNPIN