Beyond Edge Coverage: Per-Task Data-Flow Extraction at Kernel Function Boundaries via LLVM

Yunseong Kim

Coverage-guided kernel fuzzers such as syzkaller rely on edge coverage trace-pc as their sole feedback signal. This context-blind approach cannot distinguish execution paths that d…