Money quote:
The average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0%.
I suppose I shouldn’t be surprised that these things are better at breaking than fixing.