Large Language Models (LLMs) show promise for automated code repair but often struggle with the complex semantic and structural correctness required. We present SynthFix, a hybrid neural-symbolic framework that improves LLM-based vulnerability repair by unifying code synthesis with compiler-informed symbolic feedback. The core of our approach is an adaptive training strategy where a neural Router Model directs code samples to either Supervised Fine-Tuning (SFT) to learn common patterns or Reward Fine-Tuning (RFT) with symbolic rewards for complex, iterative refinement. On the FixJS (JavaScript) and CodeFlaws (C) benchmarks, SynthFix achieves up to 18% relative improvement in CodeBLEU/CrystalBLEU and 32% in Exact Match over strong SFT and RFT baselines. Our results show that this adaptive combination of training strategies, which mirrors how developers alternate between pattern application and tool feedback, significantly improves the accuracy and efficiency of LLM-based vulnerability repair. Our code and data are available at https://github.com/CoderDoge1108/SynthFix.

Large Language Model (LLM) agents increasingly act by generating, executing, and revising code, making code reasoning essential for understanding program state, diagnosing failures, and repairing behavior. Existing evaluations often measure end-to-end software engineering outcomes, obscuring which reasoning capabilities limit agents in complex, execution-grounded systems. We study this problem through Proof-of-Concept (PoC) generation, where an agent synthesizes an executable trigger that reproduces a reported crash or sanitizer failure. We instantiate this task in the Linux kernel, whose scale, statefulness, pointer-heavy value flow, memory layout, and concurrency stress long-horizon code reasoning. We decompose kernel PoC generation into four capabilities: state-machine reasoning, dynamic memory layout reasoning, value-flow reasoning, and concurrency reasoning. We build KPocInfra to emit branch-level execution telemetry and curate kPocBench, a benchmark of 181 reproducible Linux kernel KASAN cases from Syzbot. On kPocBench, state-machine and value-flow reasoning explain most failures, while capability-scaffolded evidence improves the best success rate from 50% to 61% and moves 29 unsolved attempts deeper along vulnerable execution paths. These results position kernel PoC generation as a practical stress test for LLM code reasoning in large-scale systems software.