nx_fuzz.nx

nx_fuzz.nx -- mutational input fuzzer. Generates test inputs by MUTATING existing seed inputs rather than creating them from scratch. Why mutation beats pure random: Random bytes almost never parse as valid anything. A lexer fuzz against "0xF8 0x42 0xE7 ..." spends 100% of runtime in the 'unexpected character' error path -- you never exercise deeper code. Mutation starts from a known-valid seed ("123" for a number parser, "{x: 1}" for a JSON parser) and applies small edits (bit flip, byte swap, insert, delete). The mutant is usually still CLOSE to valid, so the parser reaches deeper code paths. Classic AFL insight. Based on: AFL / AFL++ (Zalewski 2013, 2019) -- the mutation operator set libFuzzer (Serebryany 2015) -- in-process coverage-guided honggfuzz (Swiecki 2010+) -- persistent mode + dictionaries Radamsa (Aalto Uni) -- grammar-aware mutations v0.0.1 scope: * Seeded xorshift64 PRNG (reproducible across machines) * Mutation primitives: - bit flip (1 bit) - byte flip (single byte) - byte arith (+-1, +-8, +-64 on a single byte) - insert (random byte at random pos) - delete (random byte at random pos) - splice (copy chunk from one seed into another) * Corpus -- a small ring of seed inputs * Per-call `nx_fuzz_mutate(in_buf, in_len, out_buf, out_cap) -> out_len` Not yet (staged): * Coverage instrumentation -- requires nxc2 to emit __fuzz_edge counters at every branch. Big compiler change. When shipped, replaces pure-mutation with AFL-style