Fuzzing an API with Deep State (Part 2)

Summary: Trail of Bits describes using the universalmutator tool to generate 2,602 mutants of a red-black tree, of which 1,120 compile, then measuring how many each fuzzer kills within a 60-second budget. The DeepState brute-force fuzzer killed 797 mutants (71.16%), John's original fuzzer killed 822 (73.39%), and libFuzzer killed 797, with the 25-mutant gap traced to DeepState running each test in a fork so pointer-inequality mutants go undetected.
Bottom line: The 25 mutants DeepState missed were not a speed problem but a fork-environment artifact, and no amount of extra fuzzing would catch them - a reminder that a fuzzer's execution model can silently shape which bugs it is even capable of finding.

Read the original at Trail of Bits Blog ↗