I'm having trouble finding this info (I assume they won't publish it), but could the secret sauce be much larger and more readily accessible context window?
OpenBSD's code is in the 10s of millions of lines. Being able to hold all of it in context would make bug finding much easier.
You can look at some of the bugs, if you'd like. They are (at least the ones I looked at) fairly self-contained, scoped to a single function, a hundred lines or less. There's no need for a massive amount of context.
These are pretty self-contained and seems to be something more like "formal verification" where the model is able to simulate a large number of states and find incorrect ones, if I were to speculate, something akin to a reasoning loop that moved from the harness/orchestration layer down to the model itself.
OpenBSD's code is in the 10s of millions of lines. Being able to hold all of it in context would make bug finding much easier.