"this vulnerability is being sold for research purposes only and must never be used outside of a tightly controlled research sandbox"

Has anyone actually been convicted of abetting a crime by selling a vulnerability, by itself, not conspiring with the buyer to commit a crime using said vulnerability? Not as far as I can see. It would be absurd to jail someone for accurately describing a bug.