If an application sends a one way binder transaction the service tries to send a reply which fails. This causes the service manager to exit its binder loop and the process dies causing the system to reboot. Tested on Android version 6.0.1 February patches.
24774ca1e49bd4db1b9ed63ebb744a6f55a49da06db379a0c1076409bd39b4c2