People associated with the CCC most often do responsible disclosure. Therefore you can expect vulnerabilities revealed during C3 to be already known in advance

People associated with the CCC most often do responsible disclosure. Therefore you can expect vulnerabilities revealed during C3 to be already known in advance to the vendor. AFAIK an exception to that are jail breaks, which have quite a history of getting announced during C3 without disclosing them to the vendor first.