Android 17 ships a libc bug that isn't in the public source

In September 2026 Android 17 builds, libc's wcscspn() and wcspbrk() wrongly stop at any character above U+00FF, breaking parsers that handle emoji or non-Latin text. The regression exists only in device binaries: the June AOSP sources are correct, so the reporter had to disassemble libc.so from a phone to diagnose it.

• The functions return wrong results for 1,111,808 code points from U+0001 to U+10FFFF
• Public android-17.0.0_r1 sources contain correct code with no regression
• An existing bionic test asserted the wrong behavior, so the bug went unnoticed
• Google now publishes AOSP source only twice a year, starting in 2026