Finding bugs you didn't think to test for
firezone.dev
1 thread
Does coverage guidance actually help much here, or does most of the value come from having a good generator and reference model?
Coverage is just the feedback loop. If you don't have a good generator, feedback that certain areas are uncovered doesn't really help. But without coverage, the generator doesn't really explore deeper states.
Under the hood, the fuzzer actually works with _features_, not source code coverage and there are ways in explicitly giving the fuzzer additional feedback. Some early data suggests that this is very effevtive.