When a protocol vendor declines to patch, the test harness becomes the spec

When a protocol vendor confirms that a critical vulnerability is intentional, the question shifts from "when does the vendor patch this?" to "where does mitigation live now?" The answer in this case is no longer in the protocol layer, no longer in the vendor SDK, but in the harnesses, sandboxes, and