Well done. It’s important to know the difference between a real world exploitable bug and hot air; as an open source maintainer, over half of the bug reports I get are “hot air” bugs.