DNS traffic can leak outside the VPN tunnel on Android

Stock android.

You just have to grant the wireguard app root access and enable the kernel module backend in the settings.