Fuzzing
The current kernel defines 7 fuzz targets:
| Target | Primary boundary |
|---|---|
target_codec | codec |
target_composition | composition |
target_model_state | model state |
target_portable_abi | portable abi |
target_portable_codecs | portable codecs |
target_principal_parsers | principal parsers |
target_registry_handlers | registry handlers |
Expectations
Section titled “Expectations”Fuzz targets must reject malformed external input without panicking, avoid unbounded allocation, preserve deterministic outcomes, and exercise new parser or state-transition code.
cargo xtask fuzz-smoke checks target compilation and executes each committed
seed corpus for a bounded smoke interval. Longer fuzzing belongs in dedicated
CI and security campaigns.
For decisions about extending an existing target, adding a new target, or covering a new cryptographic algorithm, see Maintaining fuzz coverage.