@chris @bsdphk
If you (company) supply a patch to FOSS but don't sell the software in any way, you don't matter.
Even if you do not contribute to FOSS software but sell it in some way (e.g. as part of your product) you are liable.
If commercial vendors who incorporate FOSS software in their products are smart, the next thing we will see is a foundation that checks and certifies FOSS software, so the commercial vendors can pool their resources.