What this adds

The attack classes are strong for web apps, APIs, and services, but the skill has almost no coverage for native or low-level targets: memory safety is a single bullet, and there is nothing for kernels, parsers and decoders, reverse-engineering tooling, runtimes/JITs, or firmware. An agent pointed at a C/C++ codebase, a kernel module, or an image parser falls back to web-shaped guidance that does not fit.

This adds MEMORY-SAFETY-AND-BINARY.md, a companion to ATTACK-CLASSES.md for those targets:

• Memory-safety classes: spatial OOB (length underflow, precedence errors, sizeof(*p) depth, wire-into-fixed-buffer), temporal/UAF, type confusion (addrof/fakeobj, hierarchical-walker leaf checks), and uninitialized read-oracles.
• Kernel and privileged-interface classes: user-copy bounds + double-fetch, object-lifecycle UAF, unchecked downcasts, and power-times-reachability interfaces.
• Universal moves (incomplete-fix archaeology, trust-asymmetry, primitive-chaining) and a verification discipline tuned for the domain: read the offset from the crash, reclaim-and-compare for sanitizer-blind UAF, and prove the bounded-write case before calling something DoS-only.

It is wired in from ATTACK-CLASSES.md (a pointer routing native targets here) and listed in the README.

Why it helps

It lets the harness audit the targets it currently cannot, and the verification discipline goes after the false-positive problem where it is worst: a memory-safety claim that is not reproduced against a crash dump is almost always wrong, so the file pushes hard on empirical proof.

Contributed by Aris (youraris.com); the techniques are distilled from real, publicly disclosed CVEs across kernels, browsers, and dev tooling.