Pre-tapeout bug hunt

We look for functional bugs in your RTL before you tape out. You pay only for bugs that are verified.

The engineering is done by AI coding agents (Claude and Codex), directed by ChipLab's founder, Nathan Chandrasekar. One agent finds and documents each bug. A different agent reproduces it independently before it reaches you.

What each bug report contains

Results are private to you. We do not publish client findings or file them anywhere.

How it works

  1. Scope

    You send the RTL, the spec or design notes, and your known-issues list. We confirm the design is eligible, screen you against the US Consolidated Screening List, and agree rates and a cap in writing.

  2. Hunt

    Agents write tests and compare your design with a golden model or the spec, using open-source simulators (Verilator and Icarus Verilog).

  3. Independent reproduction

    A second agent reproduces each candidate bug from scratch. A bug it cannot reproduce is not reported.

  4. Report

    You receive each verified bug privately. You pay per verified bug, up to the cap.

  5. Delete

    At the end of the engagement we delete your files.

Pilots

We are running a small number of pre-tapeout pilots with professional teams, on published or EAR99 designs. If your design has a tapeout date coming up, email agents@donmakino.com with a link to the RTL and the spec you want it checked against.

Terms

Open-PDK shuttle deadlines

Send RTL early enough to fix what we find before your deadline.

ShuttleDeadline
Tiny Tapeout SKY26dCloses 30 November
Tiny Tapeout GF26cCloses 7 December
ChipFoundry CI2612Commitment 4 November; tapeout 7 December
wafer.space GF180 Run 3Slots close 9 December; GDS due 16 December

2026 dates as published by each platform on 10 October 2026. Check with the platform before planning around them.

Public record

The same method, run in public on open-source cores. The Conformance Matrix runs the official RISC-V architecture tests across 11 open cores. The Findings page lists every public report.

ProjectPublic issue
Hazard3
RISC-V core in Raspberry Pi's RP2350
#52 amominu.w and amomaxu.w store the signed min/max when Zbb is disabled.
Hazard3#51 A host write to data0 while an abstract command is busy changes data0; the spec says it must not.
Hazard3#50 sbcs.sbaccess resets to 8-bit instead of 32-bit when System Bus Access is enabled.
NEORV32#1663 A DMA byte-to-word transfer replicates the byte instead of zero-extending it.
NEORV32#1662 SLINK interrupt-enable bits sit at different positions in the RTL and the datasheet.
SERV#173 Reading mie clears MTIE, which disables timer interrupts.
MicrowattUnder verification.

Contact

agents@donmakino.com

Tell us what the design does, its rough size, your shuttle or tapeout date, and whether it is published or EAR99.