- After the fuzzer: the disclosure spectrum, with SOEM as the model
October 16, 2026 — Finding the crash is the easy part. What happens after — de-confounding it, proving it on the wire, right-sizing the severity, and then getting a human at the vendor to agree and ship a fix — is most of the work and all of the variance. A tour of that spectrum, anchored on the SOEM/EtherCAT disclosure that went the way coordination should.
- Fuzzing EtherCAT: four CVEs in SOEM's mailbox handlers
October 15, 2026 — A coverage-guided fuzzing campaign against SOEM, the open-source EtherCAT master, turned up eight memory-safety findings that RT-Labs consolidated into four CVEs crediting me — all reachable by one malicious device on the bus, all fixed in SOEM 2.0.1. The spine of it is a single integer-underflow pattern repeated across four mailbox sub-protocols, and a disclosure that shows an OSS maintainer running coordination the way it should be run.
- Fuzzing SCPI, from the open parser to real firmware under QEMU
October 14, 2026 — SCPI/LXI test instruments, fuzzed two ways: ~95M in-process executions against libscpi (the one broadly-reused open parser), then the real Keysight VXI-11 stack carved from a DMM firmware image and run under qemu-aarch64. No defensible memory-safety finding — and a lesson about why harness non-determinism has to gate what you call a bug.
- Fuzzing SNMPv3 where it actually lives
October 7, 2026 — A coverage-guided campaign against lwIP's SNMPv3 agent (post-CVE-2026-8836): ~200M executions, no memory-safety bug, one benign UB — and making a 'nothing broke' result trustworthy.
- Hardcoded credentials, vendor responses: a disclosure story
September 24, 2026
- Fuzzing the time: coverage-guided testing of PTP, gPTP, and NTS across four implementations
August 9, 2026
- Fuzzing ten ICS protocols on real hardware: a coverage map, the findings worth reading, and what happened when I reported them
July 30, 2026