Linux internals · reverse engineering · vulnerability research

Full-time on Linux internals, reverse engineering, and vulnerability research since January 2026. Between April and July I landed twelve patches in the mainline Linux kernel and co-developed two more, six of them backported to the stable trees, across the Realtek rtw89 and MediaTek mt76 Wi-Fi drivers. Also since January: a published CVE (CVE-2026-20161), a paid embedded-firmware reverse-engineering contract, and a clean-room Wi-Fi driver I am building from the firmware disassembly.

Available for remote contracts. Linux driver development, reverse engineering, vulnerability research. 📍 Vancouver Island, BC, Canada  ·  ✉️ devinwittmayer@gmail.com  ·  🌐 justthetip.ca  ·  ☕ Ko-fi

Merged to mainline. Patches I authored or co-developed; six carry Cc: stable, so they flow back into the long-term kernels.

Most of these share a root cause. USB and SDIO adapters, and monitor mode, run through code written and tested against PCIe cards doing ordinary client traffic, so assumptions that only ever held there sat unexercised for years. The oldest bug in the table was introduced in 2017.

Ten more in review on linux-wireless, two of them in mac80211 core rather than a driver: refusing to make a monitor interface active when it has no queue, and dropping the monitor filter counts on stop rather than only sometimes. The other eight are mt76: a USB/SDIO TX-completion RCU fix, drv_pmctrl return checks on the mt7921 and mt7925 PCIe reset paths, dev->mutex / iflist_mtx lock-inversion fixes for the same two, ACPI SAR table length validation and a NULL dereference in ACPI SAR init on mt792x, and an mt7615 fix to stop tearing down BSS/STA state for monitor vifs. Also co-developed on a MediaTek fix for an mt792x SDIO TX use-after-free.

Write and triage collaborator on morrownr/mt76: review, tester coordination, and liaison between the repo, linux-wireless, and MediaTek. The end-user install and uninstall scripts let anyone run the patched drivers without opening a kernel tree.

The AICSemi AIC8800 USB Wi-Fi family has no mainline Linux support: the vendor ships a closed firmware blob and an out-of-tree module that breaks on current kernels. I'm building an open mac80211 SoftMAC for it the way carl9170 and b43-openfwwf were built, my own firmware on the chip and mac80211 on the host, with no vendor blob and no hybrid. Those two are the only fully open Wi-Fi firmwares in mainline, both took years, and both had vendor documentation. This one does not.

Where it stands: I've reverse-engineered the chip's boot and init, the USB datapath, the TX and RX DMA rings, the firmware load mechanism, and the RF calibration (LOFT/IQ) path, all from the disassembly with no source and no datasheet. The calibration code is written and executes cleanly on the chip, but this is pre-first-light: no RF emitted yet, not a frame and not a carrier. Fourteen on-silicon fires, each byte-identical to the vendor's own emitting register state, all came back dark, which is what proved emission here is a live process and not a register state. The remaining work is a persistently running TX pipeline and the calibration that depends on it.

Bench: a self-built Wi-Fi 7 access point on a BPi-R4 Pro, with x86 and aarch64 clients.

Proved that mainline silently caps several Realtek Wi-Fi 6/6E/7 USB adapters at USB 2 speeds (258 vs 802 Mbps on identical hardware), across four adapters, three chipsets, and two host architectures. Evidence and crash reports: rtw89-usb3-gap.

Automotive keyless-entry firmware RE for a hardware-security vendor: a dozen firmware images delivered and in flight, each a byte-exact C reimplementation of the firmware's cryptography and key-derivation, validated against captured radio traffic or instruction-accurate emulation.

• Seven MCU families: STM8, ARM Cortex-M0, PIC, HCS12 / HCS12X, V850, R32C, 8051.
• The hard part was getting from a stripped flash dump to a function map. Where stock tooling fell down on paged flash and uncommon cores, I wrote a function walker, disassembler, and instruction-accurate emulator from scratch.
• Ciphers: KeeLoq variants, XTEA, AES-128, custom block and S-box ciphers, a DST80-family stream cipher, several PRNG designs.

All findings disclosed through coordinated disclosure; most have shipped fixes. Vendor names are withheld where embargoes or NDAs apply.

• Local root on a Linux network-monitoring agent: CVE-2026-20161 (Cisco ThousandEyes), my first CVE. Symlink-following plus a Linux loader feature lets any local user gain persistent system-wide root.
• Three privilege escalations in an enterprise VPN client: a Windows race to SYSTEM, a Linux command injection running as root from an unauthenticated local socket, and a Linux file-write primitive that becomes system-wide RCE. The same product also leaked credentials via a world-readable shared-memory region.
• Remote code execution in a Windows endpoint-protection product: one crafted UDP packet corrupts memory in the network-filter service. Vendor-confirmed, fix shipped.
• Cross-customer impersonation on a virtual-gateway product: a certificate-authority private key hardcoded into firmware and identical across every deployment worldwide, plus an RSA-512 license-signing key forgery (512-bit modulus factored, private key recovered), validated on a live appliance.
• Network-appliance SSRF to cloud IAM credential theft via a DNS-rebinding filter bypass that reaches the instance metadata service.
• Audit-log poisoning on an enterprise Linux EDR: a binary IPC protocol reverse-engineered into a quarantine bypass and a primitive that injects fabricated entries into the cloud admin console's audit log.

Reported through authorized programs on Bugcrowd and HackerOne, with further findings across identity, telecom, fintech, and IoT.

_{More at github.com/Lucid-Duck and justthetip.ca, built and documented as I go.}