You can find so called "specification updates", which - as the name implies - update the specs to match actually released hardware ;)
Available for all CPU families from both Intel and AMD, easily go into tens or hundreds of positions. (Though I haven't seen the Ryzen one released yet).
And then somebody recently linked this (2010) - allegedly there are bugs exploitable for privilege escalation:
http://cs.dartmouth.edu/~sergey/cs258/2010/D2T1%20-%20Kris%2...
That comes from their end.
It's a conference presentation titled "Remote Code Execution through Intel CPU Bugs" by Kris Kaspersky and Alice Chang. Google finds copies elsewhere.
I can't say that I see how the "remote" part could possibly work, but as for local exploitation, errata often state that things like "data corruption" or "unpredictable behavior" can happen under "certain internal conditions" so this stuff may be exploitable if one can execute arbitrary instructions which trigger these internal conditions.
New features are actively used, and thus actively tested. They are likely much less broken than disused old ones.
And Windows XP might be out of support but it still is used in some places too. And even if it wasn't, somebody could still think of using it as a test case to increase coverage. It would be extremely lame if some bug which crashes newer Windows in 0.1% of cases turned out to be trivially detectable in XP.
IIRC Ryzen and Kaby Lake were both announced with "only Windows 10 is going to be officially supported"…
So no reason not to use Ryzen.
You don't catch ever bug with a suite of unit tests. But automated regression tests do ensure you don't replicate a failure condition.
What I find more incredible is that this bug could get by without being noticed. A CPU literally has billions of possible regression tests --- all the world's existing software --- and of everyone working on the project, not a single one thought to try some older software (XP/2k3 is not even that old, as far as x86 compatibility is concerned) to see if it worked? This is an old feature too, meaning it should've been well-characterised by now. I'm particularly surprised that FreeDOS is affected, since it's commonly used as a minimal "non-OS" OS for running things like low-level diagnostics and debugging of hardware.
This begs the question: if old features are this broken, what about the new ones (for which there is far less software available to test them with)? I think the most recently discovered one was https://news.ycombinator.com/item?id=13924192