Kennedy Tech LLC is a registered security research company in Florida, working on
cellular modem firmware, vendor drivers and system libraries at the assembly level.
Reports have been accepted by Samsung, MediaTek, Qualcomm, NVIDIA, Nintendo and others.
One finding is published in a vendor security release this month; further work is
in coordinated disclosure.
Published research
CVE-2026-21155SVE-2026-3546Published
Out-of-bounds write in the Samsung bootloader
An out-of-bounds write in the bootloader, reachable by a physical attacker, allowing
memory outside the intended bounds to be written. Samsung's fix adds input validation
on the affected path. Reported privately and fixed ahead of public disclosure.
Reports have been accepted and acted on by the security teams below. Each entry is a
report a vendor acknowledged as valid and took through its own fix process.
SamsungCVE-2026-21155 / SVE-2026-3546, fixed in SMR Nov-2026 Release 1
MediaTekCellular modem and baseband findings
QualcommFirmware and vendor-driver findings
NVIDIAAccepted security reports
NintendoAccepted security reports
OthersAdditional vendor programs under coordinated disclosure
What we work on
Most of the work is reading disassembly of code that ships without symbols: cellular
modem firmware, baseband stacks, vendor kernel drivers, and the system libraries that
sit above them. The defects that matter are usually the ordinary ones, a length that
is not checked or a permission that is not enforced, reached by a path nobody traced
before.
Cellular modem and baseband firmware.
Parsing paths that handle network-supplied input, from the SMS and signalling layers
down to the modem's own message dispatchers.
Vendor drivers and kernel interfaces.
The boundary between an unprivileged process and a driver, where an ioctl or a
device node hands attacker-controlled data to code running at higher privilege.
System libraries and authorization.
Cross-process services that check whether a caller may act before they act on its
behalf, and what happens to the data they return.
Memory safety in shipped binaries.
Out-of-bounds access, lifetime and uninitialized-memory defects in code that has no
source available and must be read from the disassembly.
The volume of disassembly in a single baseband image is larger than one person reads
by hand. Kennedy Tech runs its own local inference hardware for triage, pattern
extraction and cross-referencing, alongside frontier models from commercial providers.
Holding local capacity means the tooling is not limited to one vendor's rate limits
or model version, and work can continue when a hosted service is unavailable.
4NVIDIA DGX Spark units for local inference and triage
2DGX stations for larger models and batch analysis
Current work
Findings are reported to the vendor first. What follows is what can be said without
identifying an unpatched issue in a shipping device.
Cellular modem message parsingCoordinated with vendor. Fix in progress.
System library authorization boundariesReported. Awaiting vendor resolution.
Credit for each will be added here once the vendor publishes its advisory.
How we work
Vendor-first, always.
Findings go to the affected vendor's security team before anyone else. Nothing is
published until the vendor has shipped a fix or the coordinated window has closed.
Bounded testing.
Work is static analysis against firmware images and drivers, plus proof-of-concept
runs on hardware we own. No testing against production systems, and no testing
against anything we have not been authorized to assess.
Reproducible evidence.
Every report carries the binary, build identifier, offsets, and a path a vendor
engineer can follow to the defect. A finding that cannot be reproduced is not reported.
Scoped to the fix.
Research aims at defects a vendor can patch and a user benefits from. No exploit
development for hire, no offensive tooling, no sale of vulnerability detail.
Contact
For security reports, disclosure coordination, or vendor program correspondence.