The --engine symsan hybrid pipeline — AFL++ parallel fuzzing plus MPI concolic
workers driven by SymSan/DFSan — run end-to-end on six real programs. Every value is the mean of three
independent 20-second rounds.
SymSan concolic – interesting test cases fed to AFL
Whole-pipeline edge coverage
AFL-dominated · concolic supplies the keys
Full results
averaged · 3 rounds each
Target
AFL cases
Concolic
(range)
Edges
Edge %
tc/s
01Read the concolic column, not the edge %. In a hybrid run AFL emits
thousands of cases and dominates raw edge coverage; SymSan's value is the interesting inputs it
solves and hands to AFL — the magic bytes, checksums and structural keys AFL can't guess.
02Bigger targets, more concolic wins. xml (50,880 edges) and sqlite
(31,552) draw the most concolic contributions — rich structure gives the solver more to crack.
03Variance is real. A single 20s round is noisy: xml scored 139, 128
and 0 across its three rounds (one round the concolic workers timed out before contributing).
The mean smooths it; the whisker shows the spread.
04uniq was the hard-won one. It needed a real SymSan runtime fix
(taint_getc dropped taint on every getc) plus a build-flag fix before its
gnulib line-comparison branches became solvable.
05Three target classes. encode/decode (base64), coreutils (uniq),
and format/engine parsers (xml, png, pcre2, sqlite) — all run through one --engine symsan
interface with engine-aware target discovery.