I've found this to be the case much more often than "occasionally" since I've started habitually comparing third-party software's behaviour to relevant specs/do

I've found this to be the case much more often than "occasionally" since I've started habitually comparing third-party software's behaviour to relevant specs/documentation rather than assuming whatever the implementation does is correct. I've caught and reported several Chrome vulnerabilities this way just in the course of normal usage, and have to work around bugs in libraries that my code depends on (often involving poking around said libraries' code for insight into the problem) on a fairly regular basis.