Coverage is just the feedback loop. If you don't have a good generator, feedback that certain areas are uncovered doesn't really help. But without coverage, the generator doesn't really explore deeper states.
Under the hood, the fuzzer actually works with _features_, not source code coverage and there are ways in explicitly giving the fuzzer additional feedback. Some early data suggests that this is very effevtive.
Does coverage guidance actually help much here, or does most of the value come from having a good generator and reference model?
Coverage is just the feedback loop. If you don't have a good generator, feedback that certain areas are uncovered doesn't really help. But without coverage, the generator doesn't really explore deeper states.
Under the hood, the fuzzer actually works with _features_, not source code coverage and there are ways in explicitly giving the fuzzer additional feedback. Some early data suggests that this is very effevtive.