Not a surprise. I got in a LOT of trouble for identifying and outlining a trivial privilege escalation attack that worked on both NIPR and SIPR. In the end I got to help write up the issue but to my knowledge they never patched it as it would have caused major issues with maintenance by closing off access needed for some legacy software patches.
What did you get into trouble for?
I was writing a program to do some remote drive upkeep and realized I needed permissions I didn't have, but could use a built in tool to do them. Then realized that meant I could take another step and use a human interface issue to gain more privilege if I wanted to.
Built a proof of concept on my personal machine at home, checked that it worked, reported it upline.
I never executed that code on our work systems and would have ended up in jail if I had. But even writing it nearly landed me there.