Register-level driver work on undocumented SoCs: video codecs, display pipelines and sensor buses.
MMIO tracing correlated against parameter sweeps, then static analysis to name what the trace proved.
Accepted patch series, reproducible images and a header your team can read without the vendor.