Cloudflare showed how to build your own vulnerability harness — a wrapper that reliably reproduces a vulnerability time after time, so you don't have to guess "did they really fix it?"

They break it down using KeyTrap (CVE-2023-50387) as an example — that very DoS hole in DNSSEC where a single specially crafted response could send a resolver into an endless crypto-grinding loop and eat up almost all the CPU. The thing is, without a stable harness such bugs are painful to test: sometimes it reproduces, sometimes it doesn't, and the patch seems applied, but who knows.

Good material if you've ever sat there poking at a PoC by hand, hoping it works this time. An engineering approach to something usually done on the fly.