It's an interesting bug, a bit like header confusion in http - two different processes/libraries treat unexpected values differently. Hopefully it'll get a CVE, but you do have to install the invalid APK (presumably only via dodgy 3rd party, or evil made with your biometrics)