ScHMuzz, our fuzzer for memory-safety violations in REE–TEE shared memory, has been accepted at NDSS’27. (With six 0-day vulnerabilities in TAs and bug bounty awards from TEE vendors, Samsung, and Xiaomi)