It seems like you could create an MLIR "ROP" dialect for these "gadgets" and actually make it nearly trivial to write exploits, by compiling your ROP dialect to

It seems like you could create an MLIR "ROP" dialect for these "gadgets" and actually make it nearly trivial to write exploits, by compiling your ROP dialect to the appropriate exploit "data" to be placed in the buffer overflow on the stack. Then you just need to find the buffer overflow opportunity to launch your exploit, using (for example) something like KLEE-style symbolic execution after doing an x86 to LLVM IR conversion on an opaque binary, or by getting access to the original (open source) code and running KLEE the normal way. Then deploy your exploit. Profit? Pretty scary stuff.