The vulnerability stems from how ethereumjs-vm's runCode function processes code buffers. The CWE-119 (buffer handling) and the advisory's focus on Buffer.from() suggest improper validation of input data. The REVERT opcode execution here is not a normal programmatic outcome but a result of malformed input exploitation. The runCode function's failure to handle such cases (due to missing input sanitization or buffer bounds checks) directly enables the DoS condition. The vendor's dispute about REVERT being 'normal' refers to expected EVM behavior but doesn't address the root cause: triggering REVERT via invalid input due to insufficient validation in runCode's buffer processing.