Comment by poet

It's possible that it is all a work of fiction, but Greg Hoglund is an accomplished security researcher. It's certainly a realistic scenario that Hoglund discovered them himself, or purchased them from someone else if he didn't have time to do the vulndev. That being said, if it is fiction it wouldn't be the first time a contracter mislead the government about competency.