I've only skimmed the PDF so far. There was one great observation I couldn't resist repeating. The font renderer is performing various checks to validate 'n',

I've only skimmed the PDF so far. There was one great observation I couldn't resist repeating. The font renderer is performing various checks to validate 'n', the count of arguments passed on the stack, to a particular function. However: Turns out, a negative value of n passes all the checks! Oops. It's possible to use this bug to target memory well beyond the stack. It's game over! The best bugs are the simplest bugs.