Or sue your ass…or file a DCMA takedown with Github.
Or all of the above.
The best likely outcome is probably “no.”
Because they have lawyers and that’s what lawyers do.
If you really really want to share the information, you might write a blog post with technical details without linking to any code. Sharing the blog to the “Facebook group” will let you assess community and corporate interest and make an informed decision.
Keep in mind that they could say yes and still do all that bad stuff anyway.
If you do this, I can nearly guarantee they will either never respond as a best case scenario, or they will object.
There is effectively zero chance a company would give you any indication that you have their blessing. Even if they don't actually care one way or another they will make the assumption that giving you any kind of positive response is nothing but a negative for themselves in terms of future liability, etc
The phrase that it is "better to ask for forgiveness than permission" exists because of situations like the one you're in.
Just publish the repo. Don't contact them. If they C&D you, take it down if you don't want to deal with the legal repercussions.
For all the same reasons that it is easy to predict how they will react if you ask, it is easy to predict how they will react if you don't and they find the repo and object. They will send you a cease and desist letter telling you to take the repo down. You will then take the repo down and face no other legal action because it will not be worth their time to make any bigger deal of it than that.
It is better to ask forgiveness than permission.