Pretty cool stuff. I built a dumber version of this a few years ago that just did differential fuzzing between actual cores from different vendors, but without

Pretty cool stuff. I built a dumber version of this a few years ago that just did differential fuzzing between actual cores from different vendors, but without feedback on microarchitectural state it didn't get very far. Good to see people demonstrating how public descriptions of your parts yield concrete security benefits.