Tesla app crash on MistOS 4.7 Android 16 for surya due to Xiaomi camera vendor tag / Camera2 issue

[Predatux]

Bug report: Tesla app crash on MistOS 4.7 Android 16 for surya due to Xiaomi camera vendor tag / Camera2 issue

Device:

• POCO X3 NFC / surya
• ROM: MistOS 4.7 Aether
• Build: MistOS-4.7-Aether-GAPPS-surya-OFFICIAL-20260522-1332
• Android: 16
• SDK: 36 / 36.1
• Security patch: 2026-05-01
• Fingerprint shown by system/vendor: POCO/surya_global/surya:12/RKQ1.211019.001/V14.0.2.0.SJGMIXM:user/release-keys
• No root / no Magisk

Affected app:

• Tesla official app from Google Play
• Package: com.teslamotors.tesla
• Version: 4.57.5-4357
• targetSdk: 35

Problem:
The Tesla app crashes immediately on launch. It does not reach login. Camera permission has not been granted yet, and blocking camera access does not fix the crash.

The crash happens inside Tesla’s React Native Vision Camera module while enumerating available camera devices.

Crash excerpt:
java.lang.IllegalArgumentException: getCameraCharacteristics:1400: Unable to retrieve camera characteristics for unknown device 25: No such file or directory (-2)
at android.hardware.camera2.CameraManager.getCameraCharacteristics(CameraManager.java:805)
at com.mrousavy.camera.react.CameraDevicesManager.getDevicesJson
at com.mrousavy.camera.react.CameraDevicesManager.sendAvailableDevicesChangedEvent
at com.mrousavy.camera.react.CameraDevicesManager.initialize

Important log sequence:

• Tesla starts normally.
• libVisionCamera.so is loaded.
• CameraManager connects to camera service.
• CameraX initializes.
• CameraRepository successfully adds cameras 0, 1, 2, 3, 4, 5, 6, 7.
• Then VisionCamera crashes when trying to call getCameraCharacteristics for device 25.
• Valid Camera2 devices exposed by dumpsys are only 0–7.

ADB camera dump:
dumpsys media.camera reports:

• Number of camera devices: 8

• Number of normal camera devices: 7

• Number of public camera devices visible to API1: 7

• Device mappings:

  • Device 0 maps to "0"
  • Device 1 maps to "1"
  • Device 2 maps to "2"
  • Device 3 maps to "3"
  • Device 4 maps to "4"
  • Device 5 maps to "6"
  • Device 6 maps to "7"

Camera dynamic info shows devices 0–7 only.

Relevant vendor tag discovery:
The value 25 does not appear as a normal Camera2 ID or logical physical ID. However, it appears in a Xiaomi vendor tag:

Camera HAL device device@3.5/legacy/2:
com.xiaomi.cameraid.role.cameraId (80450000): int32[1]
[25]

Other Xiaomi camera role IDs:

• legacy/0 → cameraId [0]
• legacy/1 → cameraId [1]
• legacy/2 → cameraId [25]
• legacy/3 → cameraId [22]
• legacy/4 → cameraId [21]
• legacy/5 → cameraId [61]
• legacy/6 → cameraId [100]
• legacy/7 → cameraId [101]

Logical multi-camera info:
Only one logical multi-camera entry was found:
android.logicalMultiCamera.physicalIds:
[2 5 0]

So device 25 is not listed as a real Camera2 device and is not listed as a logical physical camera ID. It appears only as a Xiaomi vendor role cameraId.

Hypothesis:
Tesla / react-native-vision-camera appears to read or indirectly consume the Xiaomi vendor tag com.xiaomi.cameraid.role.cameraId = 25 from Camera HAL legacy/2, then incorrectly treats 25 as a real Camera2 camera ID and calls:

CameraManager.getCameraCharacteristics("25")

Android camera service then correctly fails because valid Camera2 IDs are only 0–7, causing the app to crash.

Expected behavior:
Third-party apps using Camera2 / CameraX / VisionCamera should not receive or be led to use Xiaomi internal camera role IDs such as 25 as real Camera2 IDs.

Actual behavior:
A third-party app crashes because device 25 is exposed/consumed in a way that results in getCameraCharacteristics("25"), even though no real Camera2 device 25 exists.

Tests already performed:

• Camera app works normally.
• Main, ultra-wide, macro and front camera work.
• Tesla camera permission was not granted yet.
• Blocking global camera access did not fix it.
• AppOps CAMERA ignore did not fix it.
• camera_extensions_fallback was changed from 1 to 0 and tested; no fix.
• Reverted camera_extensions_fallback to 1.
• device_config camera disable_camera_extensions could not be changed due to user build permission restriction.
• platform_compat override could not be changed because Tesla is non-debuggable and this is a user build.
• No root is available, so vendor tags / camera HAL configs cannot be patched locally.

Useful commands used:

adb shell dumpsys package com.teslamotors.tesla | grep -i "versionName|versionCode"

adb shell dumpsys media.camera 2>&1 | grep -niE "camera id|cameraid|device|logical|physical|facing|provider|camera [0-9]"

adb shell dumpsys media.camera 2>&1 | grep -n -A2 "android.logicalMultiCamera.physicalIds"

adb shell dumpsys media.camera 2>&1 | grep -n -A2 -B2 "com.xiaomi.cameraid.role.cameraId"

adb logcat -c && adb logcat | grep -iE "tesla|mrousavy|camera|CameraDevicesManager|getCameraCharacteristics|FATAL EXCEPTION|AndroidRuntime"

Request:
Please check the camera HAL / vendor tag exposure for surya on MistOS Android 16. In particular, please verify why com.xiaomi.cameraid.role.cameraId exposes internal Xiaomi IDs like 25, 22, 21, 61, 100, 101 to third-party camera stacks in a way that can make VisionCamera call getCameraCharacteristics() on a non-existent ID.

Possible fix areas:

• Hide Xiaomi internal camera role IDs from third-party apps.
• Ensure Camera2 public camera IDs remain only 0–7.
• Add/restore auxiliary camera filtering for third-party apps.
• Check camera provider / vendor tag compatibility with Android 16 SDK 36.
• Check whether react-native-vision-camera / CameraX is being affected by Xiaomi vendor tags that should remain private to com.android.camera.
• Consider exposing aux/role cameras only to com.android.camera or privileged camera packages.