Comment 12 for bug 1441553

So, from initial investigation, seems to be a problem with mf::client_buffer_cache_size. System starts out with 3 buffers, and works okay. An overallocation occurs, which kicks one of the 3 original buffers out. (calls gralloc_module_t::unregisterBuffer()).
Android has this t̶e̶r̶r̶i̶b̶l̶e̶ quirky bit about its client-side gralloc functions that once a buffer is unmapped in the client process, you can never map it again. So when the kicked-out-original buffer comes back around to the client, it tries to set it up again, and the driver rejects the mapping. The flickering is because one of the buffers in the cycle can never be written to again in software, and is stuck in the past, while the other buffers have never been kicked out and can still be written to