I read this What does it mean to “burn a zero-day”?
I researched on google and read a few articles, this one "Shopping For Zero-Days" was particularly interesting because there is people that have companies that are in the business of just that.
Hints are given on who buys them, and I actually found Zerodium, Raytheon was mentioned, and of course governments as well.
But what is the procedure behind it? Like with Zerodium it says you have to submit it. But that can be kind of iffy I would think, specially if you are a "little guy" when there is actual companies that are dedicated to that.