the seL4 kernel has been formally verified to be an exact perfect implementation of its specification free of bugs or undefined behaviour
they also have a proofs of it inherently following some of its core security principles to a tee
like proper scientific proofs, its not up for debate, all flaws would have to be inherent to the spec and very limited in scope
this is mad