1. That someone wrote. Maybe HP got it from an OEM and it is in dozens of manufacturers' machines.

2. Would mitigate this vulnerability. And, the nasty thing about this is that it could potentially rewrite your logs. You can't trust a compromised machine to tell the truth.

3. Yup.