I've written a blog post on analysing and getting RCE on some of the bugs in the AIxCC Nginx challenge: https://roundofthree.github.io/posts/nginx-aixcc-pwn/
See Tweet