Oh yes definitely seen the reachability problem!

Good ideas on the QEMU. I guess you’d have to patch the binary if it’s expecting particular hardware etc?

Not sure what you mean by “desktop shaped”?

Can you give a concrete example of UAF on heap? I’m learning a bit on how this is done, and eventually recognised the LLM is doing something called heap spray. But that seemed to rely on hoping some object you wrote just happened to get interpreted by some process. And that was the “no, wait, pointer f isn’t y” loops.