Finding zero-day is great and all, but I really love finding bugs that were silently patched. Less disclosure work and often just as much impact.

PS. Using Ruckus Wireless APs? _Definitely_ apply the latest firmware (5.2.1 or newer).