been doing exactly this lately with camera firmware and yeah the circles thing is real, but im pretty sure its a feedback loop problem, not a model problem

the model spins because it cant test its own guesses. what fixed it for me was emulating the actual device. qemu with the vendor rootfs, real binaries running, and then every claim becomes checkable: did the daemon actually parse my input, which uid is it under, what does its own log say. once it can check things it stops guessing, getting qemu to actually boot the thing was its own little hell though, took more tries than i want to admit.

the other thing i learned the hard way: most static findings die on reachability, not on exploit primitives. so i run them in the emulator first and kill the unreachable ones cheap, before spending any time on heap work

on heap vs stack, i think that intuition is desktop shaped. device userland usually has weak or no mitigations, heap uafs are way more tractable there than youd expect

Oh yes definitely seen the reachability problem!

Good ideas on the QEMU. I guess you’d have to patch the binary if it’s expecting particular hardware etc?

Not sure what you mean by “desktop shaped”?

Can you give a concrete example of UAF on heap? I’m learning a bit on how this is done, and eventually recognised the LLM is doing something called heap spray. But that seemed to rely on hoping some object you wrote just happened to get interpreted by some process. And that was the “no, wait, pointer f isn’t y” loops.

If you really learned anything you should post your own thoughts, not whatever this lowercased Claudish is.