Google engineer uses Gemini 4 Argon and Z3 to catch Go bounds-check bugs fuzzing misses

A Google engineer who leads the company's agent skills program built a pipeline in which Gemini 4 Argon reads Go source and RISC-V disassembly and translates surviving runtime.panicBounds traps into Z3 constraints, then go test replays any satisfying input as a real reproducer. The workflow caught all three planted bugs and three latent bugs in skill-lint, while unseeded go test -fuzz missed two of the planted crashes because Go checks slices against capacity rather than length. Clipping capacity to length with data[:len(data):len(data)] made the fuzzer crash both overrun bugs in all three runs, with a median of 0.28 s and 0.17 s.