I am Neeraj Pal, also known as bsdb0y, an offensive security and vulnerability researcher with 10 years of experience analysing low-level software, operating systems, firmware, kernels and device drivers.

My early public research focused on understanding operating-system internals through source analysis and debugging. That foundation developed into vulnerability research, hardware-backed fuzzing, compiler integration, program-analysis engineering and upstream security work.

My work and independent research focus on:

  • Vulnerability discovery and exploitability assessment
  • Fuzzing
  • Reverse Engineering
  • Binary and program analysis
  • Kernel, driver and GPU security
  • GNU/Linux, OpenBSD and FreeBSD internals
  • C, C++, Python, shell scripting and assembly

I contribute to open source security through vulnerability reports, patches, technical articles and collaboration with maintainers. The Vulnerability Research page documents public findings, while the contributions below focus on implementation and upstream impact.

Selected open-source contributions

Contributions to program analysis, compiler integration, analysis validation, source indexing and upstream security fixes. Each entry links to the implementation and public review history.

SVF / LLVM / PROGRAM ANALYSIS OPEN UPSTREAM

LLVM 20+ enablement for SVF

Project: SVF is an established LLVM-based static value-flow analysis framework covering pointer analysis, whole-program value flow, memory modelling and memory-error analysis.

Impact: Established a working migration path from LLVM 16 to LLVM 20.1 across SVF's core LLVM integration, build system and test infrastructure. The work compiled on Ubuntu and macOS and exposed where the existing test pipeline remained coupled to LLVM 16-generated bitcode.

Implementation: Updated changed LLVM APIs for debug declarations, dominance frontiers, data layouts and function-exit passes; fixed platform-specific CMake linking; strengthened dependency installation and download fallbacks; upgraded GitHub Actions; and made the setup scripts LLVM 20-aware. The companion Test-Suite work updated bitcode generation, corrected an Andersen alias-analysis expectation, and added differential thresholds for Andersen deque test cases.

Upstream status: The core changes built successfully, but complete validation required redesigning how the separate test repository generates LLVM bitcode in CI. The maintainer requested that generated .bc files remain out of the pull request and that the compiler migration happen through GitHub Actions. The pull requests remain open. In later discussion, the project owner explained that time constraints prevented taking on the required test-infrastructure work.

Core implementation and reviewTest infrastructure and Andersen cases

TRAIL OF BITS MULTIPLIER / C++ / INDEXING MERGED

Reliable source indexing inside containers

Project: Multiplier is Trail of Bits' DARPA-funded code-auditing platform for preserving compiler artifacts and querying source, AST and intermediate-representation entities at whole-program scale.

Impact: Enabled Multiplier to index projects in Docker environments where its existing subprocess backend failed, including builds driven through AFL++ compiler wrappers.

Implementation: Added a selectable fork+exec backend with non-blocking pipe handling, timeouts, environment propagation and exit-status reporting. I also fixed Clang -mrelocation-model argument handling and documented both execution modes.

Validation: Tested the path with a focused C example and a real zlib indexing workflow. The contribution was reviewed, approved and merged upstream.

Merged contribution and reviewOriginal Docker indexing issue

FREEBSD / BAREBOX / SECURITY FIXES ACCEPTED AND SUBMITTED

Upstream patches and fixes

FreeBSD: Contributed the accepted fix for ping(8) integer truncation with -s, and submitted fixes for the related out-of-bounds read, out-of-bounds write and integer-overflow findings.

barebox: Contributed an accepted unreachable-code cleanup and documentation for running the bootloader in sandbox mode.

Accepted barebox changeSandbox documentation patch

Elsewhere