I pointed an AI at the smallest two tools in OpenBSD I could think of, cat and find, and found multiple bugs. One of which was a buffer overflow (albeit unlikely to be exploitable). IIRC these bugs had existed since at least the NetBSD/OpenBSD split.
Everything in C is UB: https://news.ycombinator.com/item?id=48203698
It has a very interesting protected mode of operation where every memory pointer is tagged.
So, I just ran tests and quickly found a number of memory-related bugs.
I’ve submitted some patches, but they were never accepted. These tools’ maintainers seemed very inertial to me. So maybe this is why many (low importance, I assume) issues persists there for a long time.
Whether memory safety is really that important is also not clear. Most people get hacked because they run old software or insecure configurations. So a language such as Rust which creates more supply chain risks seems problematic.
Except possibly D.J. Bernstein https://cr.yp.to/ ? Not necessarily all perfect, but designed for extreme simplicity and defense in depth, AFAIU.
But compared to some other code from the 1990s, it has lasted the test of time quite well.
https://groups.google.com/g/boring-crypto/c/48qa1kWignU/m/o8...
Nobody.