# David Strnadel — Security & AI Research

> Independent researcher in Czechia. Apple-platform vulnerability research, reverse engineering and experimental AI.

This is the author-maintained public portfolio. The HTML pages are the canonical sources; the linked Markdown and JSON editions are generated from the same published content.

Three public CVE credits come from two investigations. IOMobileFrameBuffer and Accessibility have shared attribution. AuthKit and Accessibility arose from one report split by Apple. Vendor advisories establish public credit; the writeups distinguish that credit from the author’s experiments.

The IOMobileFrameBuffer result is a crash-based kernel-read witness, not a demonstrated general readback oracle, arbitrary write or code execution. AuthKit and Accessibility notes reconstruct the original report; their raw local test archive was not recovered for this edition. VQE-in-GAN is a simulator-based preprint with a negative controlled result. JEPA research uses software/Lava simulation, not physical Intel Loihi hardware.

## Profile and career

- [Full public profile, career and AI research](https://davidstrnadel.com/index.md): Text edition of the portfolio.
- [Structured public profile](https://davidstrnadel.com/profile.json): Identity, career, education, CVE credits, attribution, evidence limits and research references.

## Security research

- [Research index](https://davidstrnadel.com/research/index.md): Three CVEs from two investigations.
- [CVE-2026-65398 · IOMobileFrameBuffer](https://davidstrnadel.com/research/cve-2026-65398/index.md): David Strnadel’s IOMobileFrameBuffer CVE-2026-65398 writeup: a missing bounds check, ARM64 analysis, on-device evidence and the limits of a kernel-read witness.
- [CVE-2026-43730 · AuthKit](https://davidstrnadel.com/research/cve-2026-43730/index.md): David Strnadel’s AuthKit CVE-2026-43730 technical note: user fingerprinting, CFPreferences access and the controls documented in the original Apple report.
- [CVE-2026-43664 · Accessibility](https://davidstrnadel.com/research/cve-2026-43664/index.md): David Strnadel’s Accessibility CVE-2026-43664 note: sensitive-data exposure through preferences, cross-process controls and the limits of the retained evidence.

## Primary sources and public identities

- [Apple security advisory: IOMobileFrameBuffer and Accessibility](https://support.apple.com/en-asia/149035): Vendor attribution and impact.
- [Apple security advisory: AuthKit](https://support.apple.com/en-asia/128067): Vendor attribution and impact.
- [VQE-in-GAN · Read the preprint](https://arxiv.org/abs/2512.12581)
- [VQE-in-GAN · Code](https://github.com/o0SilentStorm0o/VQE-in-GAN)
- [JEPA × spiking networks · Explore the research](https://github.com/o0SilentStorm0o/jepa-substrate)
- [GitHub](https://github.com/o0SilentStorm0o)
- [LinkedIn](https://www.linkedin.com/in/david-strnadel-714990245)

## Contact

- [Email David Strnadel](mailto:security@davidstrnadel.com): security@davidstrnadel.com.

## Optional

- [Selected IOMobileFrameBuffer evidence](https://davidstrnadel.com/research/evidence/iomfb-selected-evidence.txt): Public editorial excerpt, not the complete original submission or a runnable exploit.
- [Canonical HTML sitemap](https://davidstrnadel.com/sitemap.xml)