Huntail

Results

• MSRC: 3 solo reports and 4 team reports, under review.
• Upstream: virtio-win #1686. In the viosock driver, a CloseHandle racing bind() leaves the socket in the bound list for good, so a non-administrator can strand a port that nobody, administrators included, can bind again until reboot. Labeled a bug by the maintainers, who found the race wider than reported.

How it works

Frontier models already find most bugs; what they cannot do is stop reporting ones that are not there. So every gate in Huntail pushes the same way: it makes a confirmation harder to reach.

• Deterministic substrate. PE parsing, .pdata function bounds and cross-build anchor relocation are plain Python. The model only judges.
• Anchor gate. A confirmation must cite instructions (0xADDR mnem ops) that verify against the measured build.
• Adversarial panel. A refuter (kill when unsure), an interrogator (break the rejection when unsure) and an escalator each see only the claim and its evidence. An adjudicator is the only member that ends a row.
• Ledger outside the context. An exhaustive table of confirmed, rejected and unanalysed rows, so coverage cannot be faked by forgetting.

Its tool layer is Scovillain.