Speaker
Description
At LPC 2025 we introduced KFuzzTest, a framework for exposing stateless and low-state internal kernel functions, such as complex data parsers and the like, directly to a userspace fuzzer, reaching code that system-call fuzzers struggle to exercise. Developers define targets alongside their functions using a simple macro-based API, with constraints and type annotations compiled into dedicated ELF sections for automatic discovery. This follow-up reports on a year of progress and charts the path ahead.
Since last year, the patch series has matured through upstream review, with a follow-up revision that simplified the design and removed the dependency on syzkaller, lowering the barrier to adoption. With the framework stabilizing, we turn to a broader question: KFuzzTest's defining feature is a uniform, low-boilerplate interface for invoking internal functions, and that interface is useful well beyond a single fuzzing engine.
We will explore two directions. First, integration with KUnit: a fuzzing harness is naturally expressed as a specialized unit test, suggesting a guiding principle that if a function can be unit-tested, it can be fuzzed, and reusing existing test infrastructure rather than standing up new machinery.
Second, automated harness generation: writing fuzz harnesses is routine, mechanical work, and KFuzzTest's minimal interface is well suited to being driven by LLM-based agents, both to author targets and to drive fuzzing loops. We see offloading this boilerplate as a concrete value proposition.
This presentation will cover what changed over the past year, lessons from the review process, and these avenues for extending KFuzzTest's reach. We hope to use the session to gather community feedback on the most promising directions for upstreaming.