> If someone could document currently shipping devices that are still vulnerable
Chances are at this point in time: every single device.
My Nexus 6P is on the July 05 patch level. So is my 3 year old Nexus 7.
Unfortunately, most OEMs lag far behind what Nexus users are accustomed to.
I think they have released every security patch on the day of the public disclosure since the Priv released. This blog post shows the release dates up until March atleast, and they've hit the Nexus release dates on all of them.
http://blogs.blackberry.com/2016/03/beating-expectations-and...
EDIT:
The beta branch for the Priv already applies 5th August security patch. Usually the official release is not that far (a week or so AFAIK).
http://m.gsmarena.com/latest_priv_marshmallow_beta_brings_au...