Optimize, Desync, Exploit: A Luau Codegen Bug Story

This talk follows the discovery and exploitation path of a Luau codegen bug that causes optimized code to produce an inconsistent VM state, turning a hard-to-reproduce crash into code execution.

The first part covers how the bug was found through AST/syntax-aware fuzzing, reduced to a stable repro, and triaged across the specific codegen, optimization, and fast-flag settings required to trigger it.

From there, the talk looks at how this inconsistent VM state is consumed internally and how it can be shaped into useful exploitation primitives. I will walk through the path from the initial crash to controlled object confusion, then show how GC and table behavior can be used to extend the primitive into a more reliable exploit chain.