Under-Constrained Symbolic Execution:
Correctness Checking for Real Code
David A. Ramos and Dawson Engler
USENIX Security 2015
Supplemental information
Bugs discovered