A concise version, kept current.

Summary

Computer engineering student working on low-level and correctness-sensitive code, mostly C, C++, Python, and TypeScript. Fourteen commits in mainline Linux, three of them assigned CVEs, the most severe a Bluetooth use-after-free rated High at CVSS 8.8. Merged fixes in the LLVM AArch64 backend, in the Bitcoin Core PSBT combiner and descriptor parser, in ROOT and Indico at CERN, and in Tetragon, Pyrefly, Linnix, and Dify. A differential harness written for BIP 352 Silent Payments turned up an order-dependence bug that went out as a report to nine separate implementations. Four first-place hackathon finishes, including overall at JunctionX Kathmandu.

Upstream work

Linux kernel | 2026

Fourteen commits in mainline plus one accepted report, all through the mailing-list review process. Scores below are the kernel.org CNA’s.

• Bluetooth. Fixed a use-after-free in the SSP passkey handler. CVE-2026-46056, rated High at CVSS 8.8.
• DRM. AMD XDNA debug BO sync now resolves handles against the ioctl caller’s client rather than the buffer object’s stored one, so the handle namespace matches the file that supplied the handle (CVE-2026-72090, High, 7.8). In PowerVR pvr_set_uobj_array() an attacker-chosen stride walked the kernel pointer past the source array and leaked kernel memory through copy_to_user(); tagged for stable (CVE-2026-68262, High, 7.1).
• PCI. Added the Meson PCIe remove callback so the host bridge deinits and the PHY powers off. Guarded DesignWare RAS DES debugfs teardown for the case where state was never allocated. Propagated devm_add_action_or_reset() failure in Meson clock setup.
• OpenVPN. Took a peer reference before scheduling keepalive work.
• IIO. Zero-initialized the NXP SAR ADC DMA config, tagged for stable consideration.
• Tests and tooling. Added seq_buf KUnit coverage and exported seq_buf_putmem_hex(). Added next_arg() regression tests to the cmdline suite and IPv6 format tests for printf. Two fixes to the KUnit tool itself: caller args were being mutated in run_kernel, and stty ran even when stdin was not a tty.
• Reported. A request-lifetime race in the FUSE io_uring commit_fetch error path, since fixed in mainline.

LLVM | 2026

llvm/llvm-project#213490, merged August 2026. The fixed-point scvtf and ucvtf scale operands were missing the ParserMatchClass that fixedpoint_i32/i64 already had. A symbolic scale got past the parser and hit the encoder’s MO.isImm() assertion. An out-of-range scale was worse: it could assemble quietly to a different valid encoding. Fixed by giving the operands Imm1_32Operand and Imm1_64Operand, with MC diagnostics tests for both integer source widths and the symbolic case. Two AArch64 reviewers signed off.

CERN | 2026

• ROOT (#22877, merged). TFormula::HessianPar() checked the caller’s buffer against fNpar when a Hessian needs fNpar × fNpar. A two-parameter case slipped through. The fix validates the full size, and the existing ResultUpsize regression now covers it.
• Indico (#7675, merged). Under uWSGI with more than one thread and a customization directory configured, the webpack manifest reached the shared cache after __custom.css was added but before __custom.js. A second request could read it half-built and fail until the worker warmed up. It is now cached only once fully populated. The regression test pins the interleaving across two threads so the race reproduces on every run instead of occasionally. Credited in the release changelog.

Tetragon, Pyrefly, Linnix, Dify | 2026

• Cilium Tetragon (#4601, merged). Rejected returnArgAction values that kprobe return paths do not support, then carried the clarified semantics through the CRDs, docs, vendored schema copies, and examples. Helm template cleanup in #4631.
• Meta Pyrefly (commit 560fdbf, imported from #3151). Stub and interface declarations were exposing raw descriptor types instead of going through descriptor-protocol lookup. Fixed with coverage for inherited .pyi descriptors; the mypy_primer run came back with fewer false positives on real projects.
• Linnix (#43, merged). Exit-event pruning compared timestamps taken from two different clocks. Switched it to the queue timestamp with saturating subtraction and added a regression test. The same change made install paths configurable and added an uninstaller that leaves the data directory alone.
• Dify (#32163, merged). Tightened OpenTelemetry decorator typing in the API service without changing runtime behavior.

Bitcoin Core and Silent Payments | 2026

• PSBT combiner (#36025, merged August 2026). PSBTInput::m_tap_scripts maps a leaf script to a set of control blocks, but serializes one record per control block keyed by the control block, and PSBTInput::Merge unioned it by the map key. Two PSBTs mapping one control block to different leaf scripts merged into an input that serializes the PSBT_IN_TAP_LEAF_SCRIPT key twice, so combinepsbt returned a PSBT that decodepsbt then rejected as invalid. Present since v24.0. Merging per record rather than per map entry also keeps the non-conflicting control blocks that the map-level union had been dropping. Found by adding a “combining must round-trip” assertion to the PSBT fuzz target, reported with a minimal pair on #35665 and reproduced there by another contributor. Three ACKs, including the maintainer who merged it.
• Descriptors (#34697, merged August 2026 for the 32.0 release). Two fixes behind #34273. The miniscript duplicate-key check compared two key expressions by deriving each at index 0 against an empty signing provider, so any expression with a hardened step could not be derived, came back empty, and compared equal to any other such expression. A musig() descriptor reusing the same participants in one tapleaf was rejected as “contains duplicate public keys” as soon as one participant was a private key on a hardened path, while the all-xpub spelling of it imported fine. It now derives against the signing provider populated during parsing and falls back to comparing the expressions when neither side resolves. Separately, OriginPubkeyProvider::GetPubKey() prefixed its origin onto whichever entry was already in the output provider, so a participant expanded by a second expression had its origin prepended twice and m/86h/1h/0h came out as m/86h/1h/0h/86h/1h/0h in the PSBT taproot derivation maps, sending a signer to the wrong key. That second bug was found by a reviewer on this branch and fixed here.
• A Bitcoin Core TSAN timeout that only appeared intermittently traced back to glibc fortify emitting __read_chk for TokenPipeEnd::TokenRead(), which never went through TSAN’s read interceptor. A maintainer later connected the thread to the LLVM compiler-rt fix for fortified read and pread.
• In BIP 352 Silent Payments, an intermediate public-key sum landing on the point at infinity makes several implementations return a false failure. Reported with a minimal case to nine of them: spdk, bdk-sp, BlueWallet, go-bip352, shakesco-silent, vnnkl/silent-payments, libnunchuk (where maintainers confirmed a fix), Cake Wallet, and WalletWasabi. One reduction was picked up in the merged BIP-352 test vectors.
• Reviewing the OpenRPC schema work in Bitcoin Core (#35946), the generated schema described type_str arguments as number | string, but all four RPCs behind that override parse the numeric form as an integer, so 0.5 validated against the published schema and was then rejected at runtime with JSON integer out of range. A maintainer agreed with the tightening, and the author made the change, attributing the commit to me (e07d826, merged).
• Co-authored the commit finishing a legacy wallet cleanup with its author (#35955, commit 02de12b, merged). LegacyScriptPubKeyMan had been deleted earlier, but an orphaned forward declaration in wallet/rpc/util.h, the SetupLegacyScriptPubKeyMan() name, several comments, and an inactive-HD-chain log message still referred to the removed class.

Recognition

• JunctionX Kathmandu 2026. Overall winner and Hydropower & Sustainable Energy track winner as team Pikachu. Golden Ticket to the global Junction stage in Finland.
• OrchidHackX 2026. First place, Cybersecurity Track, with ShallowFake, which adds imperceptible adversarial noise to a face photo before publication so it stays normal to a viewer and difficult for a deepfake pipeline.
• HackForUHC 2026. First place as team CLAIM∅ (June 18-19). Presented at the openIMIS Community Meeting in Kathmandu (June 23-25). The project continued as NIYAM at the Health Informatics Lab, KU, and was presented at the AeHIN Hour international webinar on August 27.
• Google TMT Hackathon 2026. First place, File Translation Tool Track, as team SPAN under KU ILPRL’s Google-supported Trilingual Machine Translation project.
• PromptWars × AbhiyantriX 2026. Ranked 1st of 332 in the coding round with Orvio (96.98) and advanced to the pitching round; the worldwide-open event listed Google for Developers as a partner.

Selected work

SP-DIFFER | 2026

Runs independent BIP 352 implementations against the same semantic contract and a reference oracle, then turns any divergence into something replayable. Native C++ runner, comparator, CLI, and reporter, with semantic adapters for the reference, Rust, Go, and bdk-sp paths. Regression, fuzz, benchmark, and release-verification lanes are wired through Make. The order-dependence reports listed above all came out of it.

NIYAM | 2026

Claim validation layer that sits in front of openIMIS and catches inconsistent or invalid health insurance claims before they reach manual review. A rule engine checks each claim against configurable integrity rules, a claim adapter handles the translation so the module drops into an existing openIMIS deployment without touching its core, and a review interface shows what was flagged and why. Started as the winning project at HackForUHC 2026 (team CLAIM∅), continued at the Health Informatics Lab at KU under Prof. Rabindra Bista, and presented at the AeHIN Hour webinar on August 27, 2026.

Fluvius Predict | 2026

Forecasting and commitment tool for run-of-river hydropower. A digital cross-section reconstructs river geometry from stage and velocity and computes discharge; weather, snow, soil, and glacier signals supply basin context. Produces 1-, 3-, and 7-day discharge ranges and a 30-day energy forecast, then converts the calibrated uncertainty into a buffered commitment adjusted for machine availability and data quality. An operator gets a number to commit rather than a distribution to interpret. Python, LightGBM, PyTorch, FastAPI, React 19, TanStack Start. Won the overall prize and the Hydropower track at JunctionX Kathmandu 2026.

SANAD | 2026

Translation review workflow for public-service documents in English, Nepali, and Tamang, covering DOCX, PDF, CSV, TSV, and text. Protects named entities before the provider call, applies scoped translation memory with visible provenance, flags risky segments deterministically, and repairs damaged dates, numbers, and identifiers before a reviewer approves the export. If a provider turns 2026-04-21 into 2026-041, the fluent sentence around it does not earn the value a pass. FastAPI, React/Vite, SQLAlchemy, Gotenberg. First place, File Translation Tool Track, Google TMT Hackathon 2026.

TestLoom | 2025-26

Exam-prep platform at testloom.app, built so grading is server-authoritative: an attempt snapshots the question paper server-side, shuffles with a crypto-secure Fisher-Yates, autosaves answers, resumes in place, and hard-expires on its deadline, so correct answers never reach the client before submission.

Wrong answers feed an FSRS-6 review queue with a short relearning step, durable review history, and configurable desired retention. Graded responses update per-topic difficulty beliefs, and practice selection trades off coverage, urgency, and exposure rather than claiming one universal optimal difficulty. Confidence-tagged answering (guessing, sure, certain) surfaces confidently-wrong misconceptions. Photo-to-question import runs OCR into a human verification queue before anything enters the bank.

Analytics cover readiness, score trends, EMA-weighted topic mastery, pacing against ideal time, and an activity heatmap, with a realtime forum and an admin console for moderation and question verification. JWT access tokens with rotating refresh cookies, Redis-backed rate limiting, Helmet headers, and Playwright end-to-end tests. Nuxt 3, Vue 3, Pinia, Tailwind v4, Express 5, Mongoose, Socket.IO, MongoDB. Open source.

PaperSorted | 2026

Static archive of Kathmandu University exam papers: 561 subjects, 2,792 papers, 17 program tracks, 138 semester groupings. Build-time manifests plus extracted PDF text give both subject lookup and full paper search with no backend to run. Astro, TypeScript, Node.js, PDF.js, GitHub Pages.

Equividence | 2026

Takes a developer-approved SQLite migration promise and shrinks any violation down to a minimal, replayable counterexample. Property-based testing over a WebAssembly SQLite build. TypeScript.

ZK Guardian | 2025-26

Healthcare access prototype that verifies a clinician’s right to read FHIR R4 data with a zero-knowledge proof, keeping patient identity off-chain. Mobile app, gateway, contracts, and circuits kept in one repository. React Native, Expo, Express, Circom, Solidity, Polygon Amoy.

AXIOM-4 | 2025-26

4-bit RISC-style processor in Verilog: custom ISA, 256-byte banked memory, two-stage execution, a dedicated assembler, and a waveform test path through Icarus Verilog and GTKWave.

Education

Kathmandu University B.E. in Computer Engineering, expected Apr 2028

Skills

• Languages: C, C++, Python, TypeScript, JavaScript, Rust, Go, Verilog, SQL
• Systems: Linux kernel, LLVM and TableGen, eBPF tracing policy, PostgreSQL, Redis, MongoDB, Docker, FastAPI, Node.js and Express, Astro, React, Nuxt/Vue, React Native
• Correctness: KUnit, differential and property-based testing, fuzzing, TSAN, GDB, Git, Make, CMake, Icarus Verilog, GTKWave
• Machine learning: PyTorch, LightGBM, EasyOCR, Tesseract