I wouldn't have revealed that the second bug is a buffer overflow. The knowledge of the existence of a buffer overflow vulnerability on SIM cards is much more dangerous than knowledge of a buffer overflow on, say, a desktop O/S. Six months is a
long time for a well funded organization to fuzz such a small piece of software.
On a different note, I find it extremely frustrating that the community still has to deal with buffer overflow bugs in 2013. Hardware bounds checking architectures have existed for half a century, and SIM cards are a perfect example of special use devices that would benefit from this.