> A few years ago the ReactOS developers had to stop all development for several months to perform a source code audit.

What kind of an audit can you do without access to the original software's source code? How would you tell if it's actually different?

That's unfortunate and doesn't fit my understanding of the situation - is disassembling a binary not fair game, in the same way that Samsung buying an iPhone and cracking it open is? (Assuming we're worried about copyright and not patents).