Zero says six FatFs bugs lack upstream fixes; PoC disk images are public, but no attacks have been reported since July 1.