Systems software, security, and developer tooling. Mostly Rust, Nim, and Python.
Selected work, background, and how to reach me: leavitt.dev .
Mutating structure, not bytes: nelli's IR-aware fuzzing
I expected byte mutation to lose because its mutants die at the decoder. Measured, they decode fine. About 83% of them decode to the value you already had. nelli mutates the typed choice sequence instead, and reaches 18 edges of a parser where byte mutation reaches 2.
Sound integer abstraction in nelli's symbolic executor
A symbolic executor has to encode every integer for the solver. Bit-vectors are correct but slow; unbounded integers are fast but unsound. nelli runs on bit-vectors and abstracts to unbounded integers only where it can prove the abstraction is safe. Measured, that is worth roughly 2 to 3x on range-bounded code and nothing on bit-twiddling. It also has a hole, which this post documents.
nelli: one engine for property testing, fuzzing, and symbolic execution
nelli is a Nim testing library built on a choice-sequence engine. Because a test input is just a recorded sequence of typed choices, the same engine drives property testing, coverage-guided fuzzing, and SMT-backed symbolic execution.
Never re-initialize the camera in-process on Windows
Tearing down and re-creating a MediaCapture inside a running process can wedge the Windows Camera Frame Server for the whole machine, with a persistent E_HANDLE until the service is restarted. The only reliable recovery is a fresh process, and the fix that stuck was deleting the code that could do otherwise.
Deciding to lock your screen should be a pure function
PresenceLock locks your Windows session when you step away from the webcam. Twice it silently stopped locking while reporting that it was watching. Both bugs were caught, and both fixes were possible, because the decision to lock is a pure F# function with no clock and no I/O.
Bricking an H510 with a 4-byte write to the wrong mtd
A single 4-byte dd to the wrong MTD partition on an in-wall Ruckus H510 turned a software-recoverable experiment into a CH341A and SOIC-8 clip recovery job.
Porting the Ruckus H510 to OpenWrt
From serial console to persistent OpenWrt install on an EOL enterprise in-wall AP. The story of a from-scratch port of the Ruckus H510 to OpenWrt.
CVE-2026-42189: a pre-auth DoS in russh, found by fuzzing the right state
How designing the fuzz harness around real attacker surface, instead of pointing libfuzzer at every parser I could see, surfaced an unbounded allocation in russh’s keyboard-interactive auth in under 20 minutes.