All, I'm not ready to post it publicly, but I just wrote up a rough draft of a vendor dispute policy for CVE. If you want to see it, let me know, but please don't publish it - though you should feel free to steal any words or ideas. Maybe someday I'll get to that "best available information" document... - Steve