Respect Android API availability in the ARM64 interpreter symbol table

scripts/nix/android-iserv-arm64-api.patch

@@ -0,0 +1,14 @@
+--- a/cbits/symbols.aarch64-android.c
++++ b/cbits/symbols.aarch64-android.c
+@@ -171,8 +171,11 @@
+     SYM(htonl),
+     SYM(ntohl),
+     // sys/random.h
++    // These public Bionic APIs are declared only from API level 28.
++#if __ANDROID_API__ >= 28
+     SYM(getentropy),
+     SYM(getrandom),
++#endif
+     // sys/auxv.h
+     SYM(getauxval),
+     // sys/mman.h

scripts/nix/android-iserv-project.nix

@@ -1,20 +1,27 @@
 { config, lib, pkgs, ... }:
+let
+  arm32 = pkgs.stdenv.hostPlatform.isAarch32;
+  arm64 = pkgs.stdenv.hostPlatform.isAarch64;
+in
 lib.mkIf (
   pkgs.stdenv.hostPlatform.isAndroid
-  && pkgs.stdenv.hostPlatform.isAarch32
+  && (arm32 || arm64)
   && config.compiler-nix-name == "ghc914-sh"
   && config.name == "iserv-proxy"
 ) {
   # Patch before Cabal planning: v2 hashes must describe the same source it
-  # later packages. Bionic's real static libc routines must win at startup.
+  # later packages. Keep symbol registration consistent with the target ABI
+  # and Android API level.
   src = lib.mkForce (pkgs.pkgsBuildBuild.applyPatches {
-    name = "android-arm32-iserv-proxy-source";
+    name = "android-${if arm32 then "arm32" else "arm64"}-iserv-proxy-source";
     src = pkgs.haskell-nix.sources.iserv-proxy;
-    patches = [
+    patches = if arm32 then [
       ./android-iserv-static-libc.patch
       # The API26 project declares GNU libiconv for ghc-internal. Its real
       # definitions need explicit registration in the static interpreter.
       ./android-iserv-gnu-iconv.patch
+    ] else [
+      ./android-iserv-arm64-api.patch
     ];
   });
 }