But this seems like a reasonable approach for reverse-engineering, and it seems the bug they found is real.