diff --git a/Android.bp b/Android.bp
index b739c43..5211fe2 100644
--- a/Android.bp
+++ b/Android.bp
@@ -506,6 +506,9 @@
     },
     lint: {
         baseline_filename: "lint-baseline.xml",
+        warning_checks: [
+            "FlaggedApi",
+        ],
     },
     jarjar_prefix: "com.android.internal.hidden_from_bootclasspath",
 }
diff --git a/core/java/android/os/ServiceManagerNative.java b/core/java/android/os/ServiceManagerNative.java
index f2143f6..7b91dd5 100644
--- a/core/java/android/os/ServiceManagerNative.java
+++ b/core/java/android/os/ServiceManagerNative.java
@@ -50,7 +50,7 @@
 class ServiceManagerProxy implements IServiceManager {
     public ServiceManagerProxy(IBinder remote) {
         mRemote = remote;
-        mServiceManager = IServiceManager.Stub.asInterface(remote);
+        mServiceManager = IServiceManager.Stub.asInterface(this.getNativeServiceManager());
     }
 
     public IBinder asBinder() {
@@ -128,4 +128,6 @@
     private IBinder mRemote;
 
     private IServiceManager mServiceManager;
+
+    private native IBinder getNativeServiceManager();
 }
diff --git a/core/java/android/os/SharedMemory.java b/core/java/android/os/SharedMemory.java
index cba4423..c801fabf 100644
--- a/core/java/android/os/SharedMemory.java
+++ b/core/java/android/os/SharedMemory.java
@@ -25,6 +25,8 @@
 
 import dalvik.system.VMRuntime;
 
+import libcore.io.IoUtils;
+
 import java.io.Closeable;
 import java.io.FileDescriptor;
 import java.io.IOException;
@@ -63,7 +65,7 @@
 
         mMemoryRegistration = new MemoryRegistration(mSize);
         mCleaner = Cleaner.create(mFileDescriptor,
-                new Closer(mFileDescriptor.getInt$(), mMemoryRegistration));
+                new Closer(mFileDescriptor, mMemoryRegistration));
     }
 
     /**
@@ -276,7 +278,6 @@
      */
     @Override
     public void close() {
-        mFileDescriptor.setInt$(-1);
         if (mCleaner != null) {
             mCleaner.clean();
             mCleaner = null;
@@ -326,21 +327,20 @@
      * Cleaner that closes the FD
      */
     private static final class Closer implements Runnable {
-        private int mFd;
+        private FileDescriptor mFd;
         private MemoryRegistration mMemoryReference;
 
-        private Closer(int fd, MemoryRegistration memoryReference) {
+        private Closer(FileDescriptor fd, MemoryRegistration memoryReference) {
             mFd = fd;
+            IoUtils.setFdOwner(mFd, this);
             mMemoryReference = memoryReference;
         }
 
         @Override
         public void run() {
-            try {
-                FileDescriptor fd = new FileDescriptor();
-                fd.setInt$(mFd);
-                Os.close(fd);
-            } catch (ErrnoException e) { /* swallow error */ }
+            IoUtils.closeQuietly(mFd);
+            mFd = null;
+
             mMemoryReference.release();
             mMemoryReference = null;
         }
diff --git a/core/java/android/security/flags.aconfig b/core/java/android/security/flags.aconfig
index aadc8db..38afb80 100644
--- a/core/java/android/security/flags.aconfig
+++ b/core/java/android/security/flags.aconfig
@@ -26,14 +26,6 @@
 }
 
 flag {
-    name: "fix_unlocked_device_required_keys_v2"
-    namespace: "hardware_backed_security"
-    description: "Fix bugs in behavior of UnlockedDeviceRequired keystore keys"
-    bug: "296464083"
-    is_fixed_read_only: true
-}
-
-flag {
     name: "keyinfo_unlocked_device_required"
     is_exported: true
     namespace: "hardware_backed_security"
diff --git a/core/jni/Android.bp b/core/jni/Android.bp
index 8a230de..ce19965 100644
--- a/core/jni/Android.bp
+++ b/core/jni/Android.bp
@@ -192,6 +192,7 @@
                 "android_os_PerformanceHintManager.cpp",
                 "android_os_SELinux.cpp",
                 "android_os_ServiceManager.cpp",
+                "android_os_ServiceManagerNative.cpp",
                 "android_os_SharedMemory.cpp",
                 "android_os_storage_StorageManager.cpp",
                 "android_os_UEventObserver.cpp",
diff --git a/core/jni/AndroidRuntime.cpp b/core/jni/AndroidRuntime.cpp
index aa63f4f..9111129 100644
--- a/core/jni/AndroidRuntime.cpp
+++ b/core/jni/AndroidRuntime.cpp
@@ -148,6 +148,7 @@
 extern int register_android_os_HwRemoteBinder(JNIEnv *env);
 extern int register_android_os_NativeHandle(JNIEnv *env);
 extern int register_android_os_ServiceManager(JNIEnv *env);
+extern int register_android_os_ServiceManagerNative(JNIEnv* env);
 extern int register_android_os_MessageQueue(JNIEnv* env);
 extern int register_android_os_Parcel(JNIEnv* env);
 extern int register_android_os_PerformanceHintManager(JNIEnv* env);
@@ -1542,6 +1543,7 @@
         REG_JNI(register_android_os_HwRemoteBinder),
         REG_JNI(register_android_os_NativeHandle),
         REG_JNI(register_android_os_ServiceManager),
+        REG_JNI(register_android_os_ServiceManagerNative),
         REG_JNI(register_android_os_storage_StorageManager),
         REG_JNI(register_android_service_DataLoaderService),
         REG_JNI(register_android_view_DisplayEventReceiver),
diff --git a/core/jni/android_os_ServiceManagerNative.cpp b/core/jni/android_os_ServiceManagerNative.cpp
new file mode 100644
index 0000000..39a3013
--- /dev/null
+++ b/core/jni/android_os_ServiceManagerNative.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <binder/IServiceManagerFFI.h>
+#include <jni.h>
+#include <nativehelper/JNIHelp.h>
+
+#include "android_util_Binder.h"
+namespace android {
+
+jobject JNICALL Java_android_os_ServiceManagerProxy_getNativeServiceManager(JNIEnv *env,
+                                                                            jobject obj) {
+    sp<IBinder> service = IInterface::asBinder(
+            impl::getJavaServicemanagerImplPrivateDoNotUseExceptInTheOnePlaceItIsUsed());
+    return javaObjectForIBinder(env, service);
+}
+
+// ----------------------------------------------------------------------------
+
+static const JNINativeMethod serviceManagerNativeMethods[] = {
+        /* name, signature, funcPtr */
+        {"getNativeServiceManager", "()Landroid/os/IBinder;",
+         (void *)Java_android_os_ServiceManagerProxy_getNativeServiceManager}};
+
+int register_android_os_ServiceManagerNative(JNIEnv *env) {
+    return jniRegisterNativeMethods(env, "android/os/ServiceManagerProxy",
+                                    serviceManagerNativeMethods,
+                                    NELEM(serviceManagerNativeMethods));
+}
+} // namespace android
\ No newline at end of file
diff --git a/core/tests/coretests/src/android/content/ContentResolverTest.java b/core/tests/coretests/src/android/content/ContentResolverTest.java
index 7b70b41..c8015d4 100644
--- a/core/tests/coretests/src/android/content/ContentResolverTest.java
+++ b/core/tests/coretests/src/android/content/ContentResolverTest.java
@@ -87,7 +87,7 @@
         bitmap.compress(Bitmap.CompressFormat.PNG, 90, mImage.getOutputStream());
 
         final AssetFileDescriptor afd = new AssetFileDescriptor(
-                new ParcelFileDescriptor(mImage.getFileDescriptor()), 0, mSize, null);
+                ParcelFileDescriptor.dup(mImage.getFileDescriptor()), 0, mSize, null);
         when(mProvider.openTypedAssetFile(any(), any(), any(), any(), any())).thenReturn(
                 afd);
     }
diff --git a/location/Android.bp b/location/Android.bp
index 5ba35ac..7f3442c 100644
--- a/location/Android.bp
+++ b/location/Android.bp
@@ -39,6 +39,11 @@
             "frameworks/base/core/java",
         ],
     },
+    lint: {
+        warning_checks: [
+            "FlaggedApi",
+        ],
+    },
 }
 
 platform_compat_config {
diff --git a/packages/SystemUI/OWNERS b/packages/SystemUI/OWNERS
index 3a5ec92..9374bf4 100644
--- a/packages/SystemUI/OWNERS
+++ b/packages/SystemUI/OWNERS
@@ -8,6 +8,7 @@
 acul@google.com
 adamcohen@google.com
 aioana@google.com
+alexchau@google.com
 alexflo@google.com
 andonian@google.com
 aroederer@google.com
@@ -83,8 +84,10 @@
 rahulbanerjee@google.com
 roosa@google.com
 saff@google.com
+samcackett@google.com
 santie@google.com
 shanh@google.com
+silvajordan@google.com
 snoeberger@google.com
 steell@google.com
 stevenckng@google.com
@@ -96,6 +99,7 @@
 tracyzhou@google.com
 tsuji@google.com
 twickham@google.com
+uwaisashraf@google.com
 vadimt@google.com
 valiiftime@google.com
 vanjan@google.com
diff --git a/services/core/Android.bp b/services/core/Android.bp
index 6a3de46..fa323fd 100644
--- a/services/core/Android.bp
+++ b/services/core/Android.bp
@@ -268,6 +268,9 @@
     ],
     lint: {
         baseline_filename: "lint-baseline.xml",
+        warning_checks: [
+            "FlaggedApi",
+        ],
     },
 }
 
diff --git a/services/core/java/com/android/server/display/LocalDisplayAdapter.java b/services/core/java/com/android/server/display/LocalDisplayAdapter.java
index 88c24e0..cf4393b 100644
--- a/services/core/java/com/android/server/display/LocalDisplayAdapter.java
+++ b/services/core/java/com/android/server/display/LocalDisplayAdapter.java
@@ -48,6 +48,7 @@
 import android.view.SurfaceControl;
 
 import com.android.internal.R;
+import com.android.internal.annotations.KeepForWeakReference;
 import com.android.internal.annotations.VisibleForTesting;
 import com.android.internal.display.BrightnessSynchronizer;
 import com.android.internal.util.function.pooled.PooledLambda;
@@ -1394,8 +1395,9 @@
     }
 
     public static class Injector {
-        // Native callback.
+        // Ensure the callback is kept to preserve native weak reference lifecycle semantics.
         @SuppressWarnings("unused")
+        @KeepForWeakReference
         private ProxyDisplayEventReceiver mReceiver;
         public void setDisplayEventListenerLocked(Looper looper, DisplayEventListener listener) {
             mReceiver = new ProxyDisplayEventReceiver(looper, listener);
diff --git a/services/core/java/com/android/server/hdmi/HdmiControlService.java b/services/core/java/com/android/server/hdmi/HdmiControlService.java
index c8c66238..d5f8ead 100644
--- a/services/core/java/com/android/server/hdmi/HdmiControlService.java
+++ b/services/core/java/com/android/server/hdmi/HdmiControlService.java
@@ -143,6 +143,10 @@
     private static final String TAG = "HdmiControlService";
     private static final Locale HONG_KONG = new Locale("zh", "HK");
     private static final Locale MACAU = new Locale("zh", "MO");
+    private static final String TAIWAN_HantLanguageTag = "zh-Hant-TW";
+    private static final String HONG_KONG_HantLanguageTag = "zh-Hant-HK";
+    private static final String HONG_KONG_YUE_HantLanguageTag = "yue-Hant-HK";
+    private static final String MACAU_HantLanguageTag = "zh-Hant-MO";
 
     private static final Map<String, String> sTerminologyToBibliographicMap =
             createsTerminologyToBibliographicMap();
@@ -173,7 +177,11 @@
     }
 
     @VisibleForTesting static String localeToMenuLanguage(Locale locale) {
-        if (locale.equals(Locale.TAIWAN) || locale.equals(HONG_KONG) || locale.equals(MACAU)) {
+        if (locale.equals(Locale.TAIWAN) || locale.equals(HONG_KONG) || locale.equals(MACAU) ||
+                locale.toLanguageTag().equals(TAIWAN_HantLanguageTag) ||
+                locale.toLanguageTag().equals(HONG_KONG_HantLanguageTag) ||
+                locale.toLanguageTag().equals(HONG_KONG_YUE_HantLanguageTag) ||
+                locale.toLanguageTag().equals(MACAU_HantLanguageTag)) {
             // Android always returns "zho" for all Chinese variants.
             // Use "bibliographic" code defined in CEC639-2 for traditional
             // Chinese used in Taiwan/Hong Kong/Macau.
diff --git a/tests/ChoreographerTests/src/main/java/android/view/choreographertests/AttachedChoreographerTest.java b/tests/ChoreographerTests/src/main/java/android/view/choreographertests/AttachedChoreographerTest.java
index 5460e4e87..64dbe71 100644
--- a/tests/ChoreographerTests/src/main/java/android/view/choreographertests/AttachedChoreographerTest.java
+++ b/tests/ChoreographerTests/src/main/java/android/view/choreographertests/AttachedChoreographerTest.java
@@ -43,6 +43,7 @@
 
 import org.junit.After;
 import org.junit.Before;
+import org.junit.Ignore;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -392,6 +393,7 @@
     }
 
     @Test
+    @Ignore("Can be enabled only after b/330536267 is ready")
     public void testChoreographerDivisorRefreshRate() {
         for (int divisor : new int[]{2, 3}) {
             CountDownLatch continueLatch = new CountDownLatch(1);
@@ -420,6 +422,7 @@
     }
 
     @Test
+    @Ignore("Can be enabled only after b/330536267 is ready")
     public void testChoreographerAttachedAfterSetFrameRate() {
         Log.i(TAG, "starting testChoreographerAttachedAfterSetFrameRate");