Additional color: per the commit, the bug was found by Paulos Yibelo, who runs PwnAI (the author of this piece), and worked on security at AWS for 4 years prior.

And honestly, how the &*DK is this ANYTHING related to firecracker?