I work on correctness-critical systems software.

My focus is reproducing difficult failures, reducing them to understandable root causes, designing regression coverage, and contributing narrowly scoped fixes or independent validation upstream.

I currently work primarily with C, C++, and Rust across compiler backends, GPU validation, virtualization, firmware, cryptographic software, and test infrastructure.

Reproduce → Reduce → Understand → Test → Upstream

Production codebases. Reproducible failures. Reviewable changes.

_{Upstream states last reviewed: 22 August 2026.}

Out-of-bounds crash in static descriptor validation

An invalid pipeline could reach draw-time static descriptor validation with a shader-declared descriptor array larger than the pipeline-layout binding count.

That allowed validation to reach:

binding.descriptors[index]

with an out-of-range index.

Contribution

• Reproduced and isolated the failing validation path
• Identified the descriptor-array / binding-count mismatch
• Added a narrowly scoped early-termination guard
• Added dedicated C++ regression coverage
• Iterated on maintainer review feedback
• Passed upstream CI
• Landed in KhronosGroup:main

SILoadStoreOptimizer image-load merge correctness

TFE/LWE image loads require semantics that make certain load combinations unsafe to treat as ordinary merge candidates.

Contribution

• Added a guard rejecting invalid TFE/LWE image-load merge candidates
• Added MIR-level regression coverage
• Iterated on AMDGPU review feedback
• Rebased the patch against upstream
• Received reviewer approval / LGTM
• PR remains open pending the remaining upstream review path

Long-mode segment override prefix decoding

I independently tested an upstream fix for x86 long-mode handling of legacy segment override prefixes.

The final QEMU commit permanently records:

Tested-by: Yudistira Putra

This is independent testing and validation credit, not authorship of the underlying patch.

Reproducible differential-testing infrastructure for secp256k1 implementations

deterministic corpus
        │
        ▼
target execution
        │
        ▼
behavior comparison
        │
        ▼
failure detection
        │
        ▼
failure minimization
        │
        ▼
deterministic replay
        │
        ▼
structured evidence

Engineering focus:

• Differential testing
• Deterministic reproduction
• Correct / corrupted / synthetic target harnesses
• Failure minimization
• Replayable evidence
• Structured corpora and reporting
• Dynamic-trace experiments
• CI-backed regression verification

The project is designed around a simple requirement:

A mismatch is only useful if it can be reproduced, reduced, inspected, and replayed.

Local-first security-review infrastructure

ArkheionX builds structured review artifacts from local repositories so reviewers can reason about scope, value flow, protocol behavior, assumptions, evidence, and unresolved review gaps without requiring sensitive source code to leave the local environment.

Engineering focus:

• Local-first review workflows
• Deterministic review artifacts
• Schema-backed evidence
• Scope and value-flow mapping
• Protocol invariants and review lanes
• Evidence packaging
• Reproducibility
• Automated verification

The project deliberately keeps strong boundaries:

no RPC
no live-chain scanning
no auto-submit
no automatic vulnerability confirmation
human review required

Code4rena · Swafe

My submission S-855 was credited in Code4rena's final Swafe report as a co-finding of M-04.

The recovery request was authenticated but lacked sufficient freshness or account-state binding. A previously valid request could therefore be replayed against later recovery state.

authenticated recovery request
            │
            ▼
insufficient freshness / state binding
            │
            ▼
old request remains replayable
            │
            ▼
later recovery state overwritten
            │
            ▼
legitimate recovery disrupted

Security impact

• Replay of previously valid authenticated state transitions
• Persistent interference with account recovery
• Recovery denial of service
• Protocol state-machine / freshness failure

Code4rena's mitigation review later marked M-04 as mitigated.

OBSERVE
   ↓
REPRODUCE
   ↓
REDUCE
   ↓
UNDERSTAND
   ↓
PATCH
   ↓
REGRESSION TEST
   ↓
UPSTREAM REVIEW

I prefer small, reviewable changes backed by reproducible evidence.

The goal is not simply to make a failure disappear. The goal is to understand why it happened, demonstrate the failure reliably, and leave behind coverage that makes the same class of regression harder to reintroduce.

I'm interested in full-time, contract, and scoped engineering opportunities involving:

• Systems software in C, C++, or Rust
• Compiler engineering and backend correctness
• GPU / graphics infrastructure and validation
• Virtualization and ISA-level debugging
• RISC-V firmware
• Cryptographic software testing
• Regression and verification infrastructure
• Security-critical systems
• Difficult cross-layer debugging

Particularly interested in problems where failures are subtle, reproducibility matters, and correctness must be demonstrated rather than assumed.

$ ./engineer --mode=correctness

[+] reproduce
[+] reduce
[+] understand
[+] test
[+] upstream

ready.