VCAO: Verifier-Centered Agentic Orchestration for Strategic OS Vulnerability Discovery

We formulate operating-system vulnerability discovery as a repeated Bayesian Stackelberg search game in which a Large Reasoning Model (LRM) orchestrator allocates analysis budget across kernel files, functions, and attack paths while external verifiers -- static analyzers, fuzzers, and sanitizers -- provide evidence. At each round, the orchestrator selects a target component, an analysis method, and a time budget; observes tool outputs; updates Bayesian beliefs over latent vulnerability states; and re-solves the game to minimize the strategic attacker's expected payoff. We introduce textscVCAO (Verifier-Centered Agentic Orchestration), a six-layer architecture comprising surface mapping, intra-kernel attack-graph construction, game-theoretic file/function ranking, parallel executor agents, cascaded verification, and a safety governor. Our DOBSS-derived MILP allocates budget optimally across heterogeneous analysis tools under resource constraints, with formal tildeO(√T) regret bounds from online Stackelberg learning. Experiments on five Linux kernel subsystems -- replaying 847 historical CVEs and running live discovery on upstream snapshots -- show that textscVCAO discovers 2.7× more validated vulnerabilities per unit budget than coverage-only fuzzing, 1.9× more than static-analysis-only baselines, and 1.4× more than non-game-theoretic multi-agent pipelines, while reducing false-positive rates reaching human reviewers by 68%. We release our simulation framework, synthetic attack-graph generator, and evaluation harness as open-source artifacts.