What started as a normal-enough bug report spiraled into talk of lawyers and reaching out over the researcher's head to drag his contract employer in.