High level conclusions

Fuzzers reach 79.15% code coverage.

Fuzzers reach 51.36% of cyclomatic complexity.

Fuzzers reach 39.57% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

471 / 1190

Cyclomatic complexity statically reachable by fuzzers

3121 / 6076

Runtime code coverage of functions

942 / 1190

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzzer-pubkey

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	112	38.0%
gold	[1:9]	20	6.80%
yellow	[10:29]	4	1.36%
greenyellow	[30:49]	5	1.70%
lawngreen	50+	153	52.0%
All colors	294	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
35	62	buf_getptr	call site: 00062	write_urandom
23	38	sha256_done	call site: 00038	seedrandom
14	193	cmp_base64_key	call site: 00193	sign_key_fingerprint
5	29	sha256_init	call site: 00029	sha256_process
5	127	buf_new	call site: 00127	buf_putint
3	15	register_cipher	call site: 00015	fprintf
3	25	crypto_init	call site: 00025	genrandom
1	6	fuzz_common_setup	call site: 00006	dropbear_exit
1	8	m_malloc	call site: 00008	dropbear_exit
1	20	register_hash	call site: 00020	dropbear_exit
1	22	crypto_init	call site: 00022	dropbear_exit
1	36	sha256_done	call site: 00036	sha256_compress

Runtime coverage analysis

Covered functions

62

Functions that are reachable but not covered

50

Reachable functions

109

Percentage of reachable functions covered

54.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-pubkey.c	2
src/../fuzz/fuzz-common.c	2
src/dbutil.c	4
src/dbmalloc.c	8
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	17
src/dbhelpers.c	1
src/ecc.c	1
src/signkey.c	5
src/svr-authpubkey.c	2
libtomcrypt/src/misc/base64/base64_decode.c	2
libtomcrypt/src/misc/base64/base64_encode.c	2
src/svr-authpubkeyoptions.c	3
src/list.c	3
src/common-runopts.c	1

Fuzzer: fuzzer-kexdh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	217	49.2%
gold	[1:9]	3	0.68%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.68%
lawngreen	50+	218	49.4%
All colors	441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
36	196	mp_clear_multi	call site: 00196	mp_exptmod
23	274	s_mp_mul_digs_fast	call site: 00274	mp_mul
16	179	mp_div_2	call site: 00179	mp_sub
14	257	s_mp_sqr_fast	call site: 00257	mp_mul
10	244	mp_2expt	call site: 00244	mp_mod
9	233	mp_exptmod	call site: 00233	s_mp_exptmod
8	374	buf_putmpint	call site: 00374	buf_put_rsa_pub_key
6	103	m_free_direct	call site: 00103	mp_invmod
6	158	mp_div_2d	call site: 00158	mp_mod_2d
6	307	s_mp_exptmod_fast	call site: 00307	mp_reduce_2k_setup
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
5	150	mp_add	call site: 00150	s_mp_sub

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

31

Reachable functions

134

Percentage of reachable functions covered

76.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexdh.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	19
src/dbutil.c	2
src/bignum.c	4
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
src/kex-dh.c	2
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_clear_multi.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/dbhelpers.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexsntrup-cli

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	178	55.2%
gold	[1:9]	30	9.31%
yellow	[10:29]	4	1.24%
greenyellow	[30:49]	7	2.17%
lawngreen	50+	103	31.9%
All colors	322	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
49	206	fail_assert	call site: 00206	buf_putmpint
27	65	buf_getptr	call site: 00065	write_urandom
27	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
23	41	genrandom	call site: 00041	seedrandom
10	296	kexpqhybrid_comb_key	call site: 00296	buf_newcopy
6	309	LLVMFuzzerTestOneInput	call site: 00309	free_kexcurve25519_param
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
3	93	genrandom	call site: 00093	explicit_bzero
3	257	buf_put_rsa_pub_key	call site: 00257	buf_putmpint
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

66

Reachable functions

119

Percentage of reachable functions covered

44.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexsntrup-cli.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexecdh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	29.7%
gold	[1:9]	3	0.84%
yellow	[10:29]	1	0.28%
greenyellow	[30:49]	1	0.28%
lawngreen	50+	243	68.8%
All colors	353	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	207	s_mp_mul_digs_fast	call site: 00207	mp_mul
8	286	buf_putmpint	call site: 00286	buf_put_rsa_pub_key
6	177	mp_div_2d	call site: 00177	mp_mod_2d
6	198	mp_init_multi	call site: 00198	mp_mul
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
5	318	buf_put_ecc_raw_pubkey_string	call site: 00318	buf_put_ed25519_pub_key
4	105	mp_read_radix	call site: 00105	mp_sub_d
4	262	buf_put_pub_key	call site: 00262	buf_put_dss_pub_key
3	120	mp_init_size	call site: 00120	mp_clear
3	194	ecc_is_point	call site: 00194	s_mp_balance_mul
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

22

Reachable functions

124

Percentage of reachable functions covered

82.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexecdh.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	21
src/dbutil.c	3
src/kex-ecdh.c	1
src/ecc.c	6
src/bignum.c	2
libtommath/bn_mp_init.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_cmp_mag.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
libtommath/bn_mp_cmp_d.c	1
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
src/rsa.c	1
src/ecdsa.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/dbhelpers.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-cliconf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	577	76.9%
gold	[1:9]	48	6.4%
yellow	[10:29]	1	0.13%
greenyellow	[30:49]	1	0.13%
lawngreen	50+	123	16.4%
All colors	750	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
166	331	buf_getbyte	call site: 00331	ecc_is_point
104	210	m_free_direct	call site: 00210	buf_get_ecdsa_priv_key
41	515	loadidentityfile	call site: 00515	loadidentityfile
34	122	m_strdup	call site: 00122	add_extendedopt
32	565	buf_putbyte	call site: 00565	algolist_string
26	656	cli_getopts	call site: 00656	split_address_port
23	74	wrapfd_close	call site: 00074	write_urandom
22	694	parse_multihop_hostname	call site: 00694	multihop_args
15	38	sha256_done	call site: 00038	seedrandom
14	184	m_close	call site: 00184	buf_get_priv_key
11	62	buf_getptr	call site: 00062	sha256_process
8	200	buf_getint	call site: 00200	m_malloc

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

140

Reachable functions

207

Percentage of reachable functions covered

32.37%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-cliconf.c	2
src/../fuzz/fuzz-common.c	3
src/dbutil.c	11
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	7
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	21
src/dbhelpers.c	1
src/ecc.c	4
src/cli-runopts.c	13
src/list.c	2
src/common-runopts.c	5
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/common-algo.c	5
src/cli-readconf.c	1
src/compat.c	1

Fuzzer: fuzzer-verify

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	204	22.2%
gold	[1:9]	39	4.26%
yellow	[10:29]	10	1.09%
greenyellow	[30:49]	10	1.09%
lawngreen	50+	652	71.2%
All colors	915	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
31	62	buf_getptr	call site: 00062	write_urandom
23	38	sha256_done	call site: 00038	seedrandom
22	766	dropbear_ed25519_verify	call site: 00766	buf_sk_ecdsa_verify
9	371	s_mp_mul_digs	call site: 00371	mp_mul
6	360	mp_init_multi	call site: 00360	mp_mul
6	523	buf_dss_verify	call site: 00523	mp_exptmod
6	574	s_mp_exptmod_fast	call site: 00574	mp_reduce_2k_setup
6	875	mp_prime_is_prime	call site: 00875	mp_prime_miller_rabin
4	273	mp_read_radix	call site: 00273	mp_sub_d
3	15	register_cipher	call site: 00015	fprintf
3	94	genrandom	call site: 00094	explicit_bzero
3	356	ecc_is_point	call site: 00356	s_mp_balance_mul

Runtime coverage analysis

Covered functions

236

Functions that are reachable but not covered

45

Reachable functions

241

Percentage of reachable functions covered

81.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-verify.c	2
src/../fuzz/fuzz-common.c	2
src/dbutil.c	4
src/dbmalloc.c	11
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	2
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	20
src/dbhelpers.c	1
src/ecc.c	5
src/signkey.c	9
src/dss.c	3
src/bignum.c	4
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	4
src/ecdsa.c	4
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	3
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
src/curve25519.c	24
libtomcrypt/src/hashes/sha2/sha512.c	4
src/sk-ecdsa.c	1
src/sk-ed25519.c	1
libtommath/bn_mp_prime_rabin_miller_trials.c	1
libtommath/bn_mp_prime_is_prime.c	2
libtommath/bn_mp_is_square.c	1
libtommath/bn_mp_mod_d.c	1
libtommath/bn_mp_div_d.c	1
libtommath/bn_mp_div_3.c	1
libtommath/bn_mp_init_u32.c	1
libtommath/bn_mp_set_u32.c	1
libtommath/bn_mp_get_i32.c	1
libtommath/bn_mp_get_mag_u32.c	1
libtommath/bn_mp_sqrt.c	1
libtommath/bn_s_mp_prime_is_divisible.c	1
libtommath/bn_mp_init_set.c	1
libtommath/bn_mp_prime_miller_rabin.c	1
libtommath/bn_mp_cnt_lsb.c	1
libtommath/bn_mp_sqrmod.c	1

Fuzzer: fuzzer-kexmlkem-cli

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	178	55.2%
gold	[1:9]	10	3.10%
yellow	[10:29]	24	7.45%
greenyellow	[30:49]	7	2.17%
lawngreen	50+	103	31.9%
All colors	322	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
49	206	fail_assert	call site: 00206	buf_putmpint
27	65	buf_getptr	call site: 00065	write_urandom
27	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
23	41	genrandom	call site: 00041	seedrandom
10	296	kexpqhybrid_comb_key	call site: 00296	buf_newcopy
6	309	LLVMFuzzerTestOneInput	call site: 00309	free_kexcurve25519_param
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
3	93	genrandom	call site: 00093	explicit_bzero
3	257	buf_put_rsa_pub_key	call site: 00257	buf_putmpint
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

418

Functions that are reachable but not covered

66

Reachable functions

119

Percentage of reachable functions covered

44.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexmlkem-cli.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexcurve25519

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	79	33.7%
gold	[1:9]	1	0.42%
yellow	[10:29]	1	0.42%
greenyellow	[30:49]	11	4.70%
lawngreen	50+	142	60.6%
All colors	234	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
22	178	buf_put_pub_key	call site: 00178	buf_put_ecdsa_pub_key
8	169	buf_putmpint	call site: 00169	buf_put_rsa_pub_key
6	159	mp_div_2d	call site: 00159	mp_mod_2d
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	128	buf_put_pub_key	call site: 00128	buf_put_dss_pub_key
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress
2	117	mp_from_ubin	call site: 00117	mp_copy
1	21	sha256_done	call site: 00021	sha256_compress
1	29	buf_getint	call site: 00029	dropbear_exit
1	35	buf_getstringbuf_int	call site: 00035	dropbear_exit
1	37	buf_new	call site: 00037	dropbear_exit

Runtime coverage analysis

Covered functions

140

Functions that are reachable but not covered

23

Reachable functions

101

Percentage of reachable functions covered

77.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexcurve25519.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	20
src/dbutil.c	3
src/kex-x25519.c	2
src/curve25519.c	10
src/bignum.c	2
libtommath/bn_mp_init.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
src/dbhelpers.c	1
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-client_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1563	77.6%
gold	[1:9]	114	5.66%
yellow	[10:29]	4	0.19%
greenyellow	[30:49]	1	0.04%
lawngreen	50+	332	16.4%
All colors	2014	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
294	1569	buf_has_algo	call site: 01569	send_msg_userauth_pubkey
277	1195	cli_sessionloop	call site: 01195	gen_kexdh_param
153	332	buf_getbyte	call site: 00332	ecc_is_point
99	1867	cbuf_new	call site: 01867	setup_localtcp
75	1484	cli_auth_getmethods	call site: 01484	cli_auth_try
62	1091	session_loop	call site: 01091	check_close
50	249	m_realloc	call site: 00249	buf_get_rsa_priv_key
42	611	parse_hostname	call site: 00611	read_config_file
42	905	session_loop	call site: 00905	connect_try_next
39	518	list_append	call site: 00518	loadidentityfile
34	123	m_strdup	call site: 00123	add_extendedopt
32	212	buf_get_priv_key	call site: 00212	buf_get_dss_priv_key

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

314

Reachable functions

469

Percentage of reachable functions covered

33.05%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-client_nomaths.c	1
src/../fuzz/fuzz-common.c	8
src/dbutil.c	18
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	8
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	26
src/dbhelpers.c	1
src/ecc.c	6
src/cli-runopts.c	13
src/list.c	3
src/common-runopts.c	5
src/signkey.c	12
src/dss.c	5
src/bignum.c	4
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	6
src/ecdsa.c	5
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	5
src/common-algo.c	8
src/cli-readconf.c	1
src/compat.c	2
src/cli-session.c	6
src/common-session.c	13
src/netio.c	13
src/queue.c	5
src/common-channel.c	18
src/listener.c	6
src/packet.c	11
src/common-kex.c	4
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	6
src/atomicio.c	1
src/process-packet.c	2
src/cli-kex.c	2
src/kex-dh.c	3
src/kex-ecdh.c	2
src/kex-x25519.c	2
src/kex-pqhybrid.c	2
libtommath/bn_mp_set_ul.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ecc_make_key.c	1
libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
src/curve25519.c	21
src/cli-auth.c	3
src/cli-authpubkey.c	3
src/cli-agentfwd.c	5
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_addmod.c	1
libtomcrypt/src/hashes/sha2/sha512.c	4
src/cli-authinteract.c	1
src/cli-authpasswd.c	1
src/cli-chansession.c	4
src/cli-tcpfwd.c	5
src/tcp-accept.c	3

Fuzzer: fuzzer-preauth_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	498	47.2%
gold	[1:9]	195	18.4%
yellow	[10:29]	16	1.51%
greenyellow	[30:49]	2	0.18%
lawngreen	50+	344	32.6%
All colors	1055	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	947	session_loop	call site: 00947	check_close
42	761	session_loop	call site: 00761	connect_try_next
27	178	m_close	call site: 00178	parse_recv_window
23	125	m_strdup	call site: 00125	addportandaddress
21	829	checktimeouts	call site: 00829	send_msg_kexinit
20	74	wrapfd_remove	call site: 00074	write_urandom
16	39	sha256_done	call site: 00039	seedrandom
16	583	fuzz_get_socket_address	call site: 00583	getaddrstring
11	467	s_mp_mul_digs_fast	call site: 00467	mp_mul
10	454	ecc_is_point	call site: 00454	s_mp_balance_mul
9	166	buf_new	call site: 00166	buf_readfile
7	150	m_free_direct	call site: 00150	addhostkey

Runtime coverage analysis

Covered functions

260

Functions that are reachable but not covered

119

Reachable functions

303

Percentage of reachable functions covered

60.73%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-preauth_nomaths.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	15
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	3
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	4
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-postauth_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	424	40.1%
gold	[1:9]	191	18.1%
yellow	[10:29]	24	2.27%
greenyellow	[30:49]	1	0.09%
lawngreen	50+	415	39.3%
All colors	1055	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
31	761	session_loop	call site: 00761	connect_try_next
27	178	m_close	call site: 00178	parse_recv_window
23	125	m_strdup	call site: 00125	addportandaddress
21	829	checktimeouts	call site: 00829	send_msg_kexinit
20	74	wrapfd_remove	call site: 00074	write_urandom
16	39	sha256_done	call site: 00039	seedrandom
16	583	fuzz_get_socket_address	call site: 00583	getaddrstring
11	467	s_mp_mul_digs_fast	call site: 00467	mp_mul
10	454	ecc_is_point	call site: 00454	s_mp_balance_mul
9	166	buf_new	call site: 00166	buf_readfile
7	150	m_free_direct	call site: 00150	addhostkey
7	694	hmac_init	call site: 00694	hash_memory

Runtime coverage analysis

Covered functions

340

Functions that are reachable but not covered

101

Reachable functions

303

Percentage of reachable functions covered

66.67%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-postauth_nomaths.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	15
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	3
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	4
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-preauth

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	482	45.6%
gold	[1:9]	160	15.1%
yellow	[10:29]	8	0.75%
greenyellow	[30:49]	1	0.09%
lawngreen	50+	404	38.2%
All colors	1055	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	947	session_loop	call site: 00947	check_close
42	761	session_loop	call site: 00761	connect_try_next
27	178	m_close	call site: 00178	parse_recv_window
23	125	m_strdup	call site: 00125	addportandaddress
21	829	checktimeouts	call site: 00829	send_msg_kexinit
20	74	wrapfd_remove	call site: 00074	write_urandom
16	39	sha256_done	call site: 00039	seedrandom
16	583	fuzz_get_socket_address	call site: 00583	getaddrstring
11	467	s_mp_mul_digs_fast	call site: 00467	mp_mul
9	166	buf_new	call site: 00166	buf_readfile
7	150	m_free_direct	call site: 00150	addhostkey
7	694	hmac_init	call site: 00694	hash_memory

Runtime coverage analysis

Covered functions

368

Functions that are reachable but not covered

114

Reachable functions

303

Percentage of reachable functions covered

62.38%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-preauth.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	15
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	3
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	4
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1037	51.4%
gold	[1:9]	129	6.40%
yellow	[10:29]	11	0.54%
greenyellow	[30:49]	7	0.34%
lawngreen	50+	830	41.2%
All colors	2014	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
156	1810	par25519	call site: 01810	setup_localtcp
81	1091	session_loop	call site: 01091	check_close
45	1711	rsa_pad_em	call site: 01711	mp_exptmod
43	1484	cli_auth_getmethods	call site: 01484	cli_auth_try
42	611	parse_hostname	call site: 00611	read_config_file
42	905	session_loop	call site: 00905	connect_try_next
39	518	list_append	call site: 00518	loadidentityfile
39	1658	sha1_done	call site: 01658	buf_put_rsa_sign
34	123	m_strdup	call site: 00123	add_extendedopt
26	1622	buf_put_pub_key	call site: 01622	cli_buf_put_sign
25	573	buf_put_algolist_all	call site: 00573	algolist_string
24	970	checktimeouts	call site: 00970	send_msg_kexinit

Runtime coverage analysis

Covered functions

636

Functions that are reachable but not covered

184

Reachable functions

469

Percentage of reachable functions covered

60.77%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-client.c	1
src/../fuzz/fuzz-common.c	8
src/dbutil.c	18
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	8
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	26
src/dbhelpers.c	1
src/ecc.c	6
src/cli-runopts.c	13
src/list.c	3
src/common-runopts.c	5
src/signkey.c	12
src/dss.c	5
src/bignum.c	4
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	6
src/ecdsa.c	5
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	5
src/common-algo.c	8
src/cli-readconf.c	1
src/compat.c	2
src/cli-session.c	6
src/common-session.c	13
src/netio.c	13
src/queue.c	5
src/common-channel.c	18
src/listener.c	6
src/packet.c	11
src/common-kex.c	4
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	6
src/atomicio.c	1
src/process-packet.c	2
src/cli-kex.c	2
src/kex-dh.c	3
src/kex-ecdh.c	2
src/kex-x25519.c	2
src/kex-pqhybrid.c	2
libtommath/bn_mp_set_ul.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ecc_make_key.c	1
libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
src/curve25519.c	21
src/cli-auth.c	3
src/cli-authpubkey.c	3
src/cli-agentfwd.c	5
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_addmod.c	1
libtomcrypt/src/hashes/sha2/sha512.c	4
src/cli-authinteract.c	1
src/cli-authpasswd.c	1
src/cli-chansession.c	4
src/cli-tcpfwd.c	5
src/tcp-accept.c	3

Fuzzer: fuzzer-kexmlkem-srv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	45.8%
gold	[1:9]	25	7.73%
yellow	[10:29]	24	7.43%
greenyellow	[30:49]	18	5.57%
lawngreen	50+	108	33.4%
All colors	323	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
27	65	buf_getptr	call site: 00065	write_urandom
23	41	genrandom	call site: 00041	seedrandom
22	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
12	209	buf_putstring	call site: 00209	buf_putmpint
11	249	mp_div_2d	call site: 00249	buf_put_rsa_pub_key
7	241	mp_div_2d	call site: 00241	mp_mod_2d
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
4	203	buf_put_pub_key	call site: 00203	buf_put_dss_pub_key
3	93	genrandom	call site: 00093	explicit_bzero
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

463

Functions that are reachable but not covered

44

Reachable functions

119

Percentage of reachable functions covered

63.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexmlkem-srv.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexsntrup-srv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	45.8%
gold	[1:9]	51	15.7%
yellow	[10:29]	2	0.61%
greenyellow	[30:49]	15	4.64%
lawngreen	50+	107	33.1%
All colors	323	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
27	65	buf_getptr	call site: 00065	write_urandom
23	41	genrandom	call site: 00041	seedrandom
22	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
12	209	buf_putstring	call site: 00209	buf_putmpint
11	249	mp_div_2d	call site: 00249	buf_put_rsa_pub_key
7	241	mp_div_2d	call site: 00241	mp_mod_2d
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
4	203	buf_put_pub_key	call site: 00203	buf_put_dss_pub_key
3	93	genrandom	call site: 00093	explicit_bzero
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

44

Reachable functions

119

Percentage of reachable functions covered

63.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexsntrup-srv.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
crypto_kem_mlkem768_dec	/src/dropbear/src/mlkem768.c	3	['N/A', 'N/A', 'N/A']	16	0	31	3	2	311	0	743	737
chansessionrequest	/src/dropbear/src/svr-chansession.c	1	['N/A']	13	0	179	39	12	216	0	846	359
send_msg_kexdh_reply	/src/dropbear/src/svr-kex.c	2	['N/A', 'N/A']	14	0	148	18	4	320	1	2024	168
ltc_ecc_projective_add_point	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	3	0	1362	209	86	6	0	163	146
crypto_kem_sntrup761_dec	/src/dropbear/src/sntrup761.c	3	['N/A', 'N/A', 'N/A']	7	0	93	7	3	39	0	147	114
crypto_kem_sntrup761_keypair	/src/dropbear/src/sntrup761.c	2	['N/A', 'N/A']	14	0	54	7	3	62	0	275	83
svr_auth_pubkey	/src/dropbear/src/svr-authpubkey.c	1	['int']	13	0	369	55	19	264	1	1706	68
crypto_kem_mlkem768_keypair	/src/dropbear/src/mlkem768.c	2	['N/A', 'N/A']	16	0	36	3	2	273	0	702	65
ltc_ecc_mul2add	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mul2add.c	6	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	4	0	864	132	42	17	0	103	56
dropbear_chachapoly_crypt	/src/dropbear/src/chachapoly.c	7	['int', 'N/A', 'N/A', 'size_t', 'size_t', 'N/A', 'int']	4	0	173	25	10	13	0	62	52

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

959 / 1190

Cyclomatic complexity statically reachable by fuzzers

4905 / 6076

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

src/../fuzz/fuzzer-pubkey.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'sha256_done', 'cmp_base64_key', 'sha256_init', 'buf_new', 'register_cipher', 'crypto_init', 'fuzz_common_setup', 'm_malloc', 'register_hash']

src/../fuzz/fuzzer-kexdh.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['mp_clear_multi', 's_mp_mul_digs_fast', 'mp_div_2', 's_mp_sqr_fast', 'mp_2expt', 'mp_exptmod', 'buf_putmpint', 'm_free_direct', 'mp_div_2d', 's_mp_exptmod_fast']

src/../fuzz/fuzzer-kexsntrup-cli.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['fail_assert', 'buf_getptr', 'buf_put_pub_key', 'genrandom', 'kexpqhybrid_comb_key', 'LLVMFuzzerTestOneInput', 'fuzz_set_input', 'buf_put_rsa_pub_key']

src/../fuzz/fuzzer-kexecdh.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['s_mp_mul_digs_fast', 'buf_putmpint', 'mp_div_2d', 'mp_init_multi', 'fuzz_set_input', 'buf_put_ecc_raw_pubkey_string', 'mp_read_radix', 'buf_put_pub_key', 'mp_init_size', 'ecc_is_point']

src/../fuzz/fuzzer-cliconf.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getbyte', 'm_free_direct', 'loadidentityfile', 'm_strdup', 'buf_putbyte', 'cli_getopts', 'wrapfd_close', 'parse_multihop_hostname', 'sha256_done', 'm_close']

src/../fuzz/fuzzer-verify.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'sha256_done', 'dropbear_ed25519_verify', 's_mp_mul_digs', 'mp_init_multi', 'buf_dss_verify', 's_mp_exptmod_fast', 'mp_prime_is_prime', 'mp_read_radix', 'register_cipher']

src/../fuzz/fuzzer-kexmlkem-cli.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['fail_assert', 'buf_getptr', 'buf_put_pub_key', 'genrandom', 'kexpqhybrid_comb_key', 'LLVMFuzzerTestOneInput', 'fuzz_set_input', 'buf_put_rsa_pub_key']

src/../fuzz/fuzzer-kexcurve25519.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_put_pub_key', 'buf_putmpint', 'mp_div_2d', 'fuzz_set_input', 'sha256_init', 'fuzz_seed', 'mp_from_ubin', 'sha256_done', 'buf_getint']

src/../fuzz/fuzzer-client_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_has_algo', 'cli_sessionloop', 'buf_getbyte', 'cbuf_new', 'cli_auth_getmethods', 'session_loop', 'm_realloc', 'parse_hostname', 'list_append']

src/../fuzz/fuzzer-preauth_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_close', 'm_strdup', 'checktimeouts', 'wrapfd_remove', 'sha256_done', 'fuzz_get_socket_address', 's_mp_mul_digs_fast', 'ecc_is_point']

src/../fuzz/fuzzer-postauth_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_close', 'm_strdup', 'checktimeouts', 'wrapfd_remove', 'sha256_done', 'fuzz_get_socket_address', 's_mp_mul_digs_fast', 'ecc_is_point', 'buf_new']

src/../fuzz/fuzzer-preauth.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_close', 'm_strdup', 'checktimeouts', 'wrapfd_remove', 'sha256_done', 'fuzz_get_socket_address', 's_mp_mul_digs_fast', 'buf_new']

src/../fuzz/fuzzer-client.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['par25519', 'session_loop', 'rsa_pad_em', 'cli_auth_getmethods', 'parse_hostname', 'list_append', 'sha1_done', 'm_strdup', 'buf_put_pub_key']

src/../fuzz/fuzzer-kexmlkem-srv.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'genrandom', 'buf_put_pub_key', 'buf_putstring', 'mp_div_2d', 'fuzz_set_input', 'kexpqhybrid_comb_key']

src/../fuzz/fuzzer-kexsntrup-srv.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'genrandom', 'buf_put_pub_key', 'buf_putstring', 'mp_div_2d', 'fuzz_set_input', 'kexpqhybrid_comb_key']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
mp_exptmod	41	18	43.90%	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-client']
signkey_key_ptr	37	16	43.24%	['fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-kexcurve25519', 'fuzzer-verify', 'fuzzer-cliconf', 'fuzzer-kexmlkem-srv', 'fuzzer-client_nomaths', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-kexsntrup-cli', 'fuzzer-postauth_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client', 'fuzzer-preauth_nomaths']
svr_getopts	265	82	30.94%	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-preauth_nomaths']
cli_getopts	336	154	45.83%	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexmlkem-cli', 'fuzzer-kexsntrup-cli', 'fuzzer-client']
parse_multihop_hostname	33	16	48.48%	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexmlkem-cli', 'fuzzer-kexsntrup-cli', 'fuzzer-client']
mp_montgomery_reduce	45	10	22.22%	['fuzzer-client', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexecdh']
mp_prime_is_prime	128	59	46.09%	['fuzzer-verify']
mp_reduce	52	26	50.0%	['fuzzer-client', 'fuzzer-verify']
mp_sqrt	44	23	52.27%	['fuzzer-verify']
s_mp_mul_digs	41	12	29.26%	['fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-preauth_nomaths']
s_mp_mul_high_digs	40	13	32.5%	['fuzzer-client', 'fuzzer-verify']
buf_ecdsa_verify	98	53	54.08%	['fuzzer-client', 'fuzzer-verify']
libcrux_sha3_generic_keccak_keccak_e9	61	20	32.78%	['fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli']
libcrux_sha3_generic_keccak_keccak_e91	61	29	47.54%	['fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli']
libcrux_sha3_generic_keccak_keccak_e90	61	29	47.54%	['fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli']
cli_sessionloop	91	33	36.26%	['fuzzer-client', 'fuzzer-client_nomaths']
checktimeouts	36	15	41.66%	['fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-preauth_nomaths']
set_sock_priority	40	8	20.0%	['fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-preauth_nomaths']
write_packet	33	18	54.54%	['fuzzer-client_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-preauth_nomaths']
ctr_encrypt	38	14	36.84%	['fuzzer-postauth_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-preauth']
ctr_start	44	22	50.0%	['fuzzer-postauth_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-preauth']
svr_auth_password	64	30	46.87%	['fuzzer-preauth_nomaths', 'fuzzer-preauth']
svr_auth_pubkey	109	56	51.37%	['fuzzer-preauth_nomaths', 'fuzzer-preauth']
svr_chansess_checksignal	35	6	17.14%	['fuzzer-postauth_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-preauth']
spawn_command	68	11	16.17%	['fuzzer-postauth_nomaths']
connect_remote	40	18	45.0%	['fuzzer-postauth_nomaths']
connect_streamlocal	34	16	47.05%	['fuzzer-postauth_nomaths']
dropbear_listen	117	13	11.11%	['fuzzer-client', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths']
pty_setowner	45	14	31.11%	['fuzzer-postauth_nomaths']
svr_agentcleanup	34	8	23.52%	['fuzzer-postauth_nomaths']
ptycommand	78	14	17.94%	['fuzzer-postauth_nomaths']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/dropbear/src/kex-dh.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_sub.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_mul_digs_fast.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/helper/hash_memory.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_div.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_free.c	['fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/packet.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cnt_lsb.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_div_2d.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mulmod_timing.c	[]	[]
/src/dropbear/libtommath/bn_mp_sqr.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/sha2/sha512.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_get_mag_ul.c	[]	[]
/src/dropbear/libtommath/bn_mp_prime_next_prime.c	[]	[]
/src/dropbear/src/bignum.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mod_2d.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/svr-authpasswd.c	[]	[]
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_setup.c	[]	[]
/src/dropbear/src/dbrandom.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_s_mp_sqr_fast.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_dr_is_modulus.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/svr-auth.c	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']
/src/dropbear/libtommath/bn_s_mp_montgomery_reduce_fast.c	[]	[]
/src/dropbear/src/gendss.c	[]	[]
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_decrypt.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_exptmod.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cmp_mag.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/sk-ecdsa.c	['fuzzer-verify']	[]
/src/dropbear/src/ecc.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/src/netio.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_prng.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_from_ubin.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_argchk.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	[]
/src/dropbear/libtommath/bn_mp_get_i32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-kexsntrup-cli.c	['fuzzer-kexsntrup-cli']	[]
/src/dropbear/libtommath/bn_mp_init_copy.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_start.c	[]	[]
/src/dropbear/libtomcrypt/src/hashes/sha2/sha256.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_mp_exptmod.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/kex-x25519.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_mp_mul_d.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/dss.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_mp_prime_rabin_miller_trials.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/compat.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-client.c	['fuzzer-client']	[]
/src/dropbear/src/sntrup761_compat.h	[]	[]
/src/dropbear/src/svr-runopts.c	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_find_cipher.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_dbl_point.c	[]	[]
/src/dropbear/src/../fuzz/fuzz-common.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	[]
/src/dropbear/libtomcrypt/src/headers/tomcrypt_macros.h	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/process-packet.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_mul_high_digs.c	[]	[]
/src/dropbear/src/cli-agentfwd.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/src/svr-tcpfwd.c	[]	[]
/src/dropbear/libtommath/bn_mp_reduce_2k_setup_l.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/cli-auth.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_zero.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_s_mp_mul_high_digs_fast.c	[]	[]
/src/dropbear/src/svr-session.c	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']
/src/dropbear/libtommath/bn_mp_rshd.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/src/cli-session.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_sqr.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-verify']
/src/dropbear/src/list.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-pubkey.c	['fuzzer-pubkey']	[]
/src/dropbear/src/ed25519.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/src/circbuffer.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-postauth_nomaths']
/src/dropbear/src/queue.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/cli-channel.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_add.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_sqrmod.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_abs.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_invmod.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_set_ul.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/genrsa.c	[]	[]
/src/dropbear/libtommath/bn_mp_get_l.c	[]	[]
/src/dropbear/libtommath/bn_mp_init_u32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/gened25519.c	[]	[]
/src/dropbear/src/kex-pqhybrid.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-cli', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-cli', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mul2add.c	[]	[]
/src/dropbear/src/cli-authinteract.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_process.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_cipher.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k.c	[]	[]
/src/dropbear/libtommath/bn_mp_2expt.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/cli-authpubkey.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/src/svr-kex.c	[]	[]
/src/dropbear/libtommath/bn_mp_init_set.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-kexmlkem-cli.c	['fuzzer-kexmlkem-cli']	[]
/src/dropbear/libtommath/bn_s_mp_invmod_slow.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/src/cli-runopts.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/tcp-accept.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_set.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_crypt.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_balance_mul.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_div_3.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/svr-agentfwd.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_find_hash.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-postauth_nomaths.c	['fuzzer-postauth_nomaths']	[]
/src/dropbear/src/svr-service.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/src/ltc_prng.c	[]	[]
/src/dropbear/src/../fuzz/fuzzer-kexecdh.c	['fuzzer-kexecdh']	[]
/src/dropbear/libtommath/bn_mp_mod_d.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_montgomery_reduce.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_make_key.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/libtomcrypt/src/math/ltm_desc.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']
/src/dropbear/src/../fuzz/fuzzer-client_nomaths.c	['fuzzer-client_nomaths']	[]
/src/dropbear/libtommath/bn_mp_montgomery_setup.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_neg.c	[]	[]
/src/dropbear/libtomcrypt/src/ciphers/aes/aes.c	[]	[]
/src/dropbear/libtommath/bn_mp_init.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cmp_d.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/base64/base64_decode.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/libtommath/bn_mp_clamp.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_mp_prime_is_prime.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/cli-tcpfwd.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/libtommath/bn_mp_reduce_setup.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/kex-ecdh.c	['fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/src/crypto_desc.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_is_2k_l.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_init.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']
/src/dropbear/libtommath/bn_s_mp_exptmod_fast.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/svr-authpubkeyoptions.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/libtommath/bn_mp_montgomery_calc_normalization.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	[]	[]
/src/dropbear/src/svr-authpubkey.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_hash.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_gcd.c	[]	[]
/src/dropbear/src/../fuzz/fuzzer-kexsntrup-srv.c	['fuzzer-kexsntrup-srv']	[]
/src/dropbear/libtommath/bn_mp_init_multi.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/common-runopts.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_invmod_fast.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_prime_is_divisible.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/misc/zeromem.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-kexmlkem-srv.c	['fuzzer-kexmlkem-srv']	[]
/src/dropbear/libtommath/bn_mp_mul_2d.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/dbhelpers.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/src/dbmalloc.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtomcrypt/src/hashes/sha1.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/common-algo.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k_l.c	[]	[]
/src/dropbear/libtommath/bn_mp_ubin_size.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_prime_miller_rabin.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_reverse.c	[]	[]
/src/dropbear/src/cli-chansession.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-kexcurve25519.c	['fuzzer-kexcurve25519']	[]
/src/dropbear/src/sshpty.c	[]	[]
/src/dropbear/libtommath/bn_mp_mulmod.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_keystream.c	[]	[]
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_done.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']
/src/dropbear/libtommath/bn_mp_mul.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/signkey.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_mp_add.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mul_2.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/atomicio.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	[]
/src/dropbear/libtomcrypt/src/misc/base64/base64_encode.c	['fuzzer-pubkey']	[]
/src/dropbear/libtomcrypt/src/math/multi.c	['fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_lshd.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/sk-ed25519.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_encrypt.c	[]	[]
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_ivctr64.c	[]	[]
/src/dropbear/src/buffer.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/src/../fuzz/fuzz-wrapfd.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	[]
/src/dropbear/src/cli-readconf.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-cliconf']
/src/dropbear/libtommath/bn_mp_lcm.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c	[]	[]
/src/dropbear/libtommath/bn_mp_count_bits.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/src/common-session.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/ecdsa.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_mp_to_ubin.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-kexcurve25519', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzz-sshpacketmutator.c	[]	[]
/src/dropbear/src/common-channel.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_add_d.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_addmod.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_copy.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_mp_mod.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/dbutil.c	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-pubkey', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/src/loginrec.c	[]	[]
/src/dropbear/src/cli-authpasswd.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_reduce_is_2k.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-verify.c	['fuzzer-verify']	[]
/src/dropbear/libtomcrypt/src/mac/poly1305/poly1305.c	[]	[]
/src/dropbear/libtommath/bn_mp_rand.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_cipher_is_valid.c	[]	[]
/src/dropbear/libtommath/bn_mp_set_u32.c	['fuzzer-verify']	[]
/src/dropbear/src/gensignkey.c	[]	[]
/src/dropbear/libtommath/bn_mp_clear_multi.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/libcrux_mlkem768_sha3.h	[]	[]
/src/dropbear/src/rsa.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_mp_sub_d.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-preauth_nomaths.c	['fuzzer-preauth_nomaths']	[]
/src/dropbear/libtommath/bn_s_mp_sub.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_grow.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_mp_get_mag_u32.c	['fuzzer-verify']	[]
/src/dropbear/libtomcrypt/src/hashes/sha2/sha384.c	[]	[]
/src/dropbear/src/../fuzz/fuzzer-kexdh.c	['fuzzer-kexdh']	[]
/src/dropbear/src/../fuzz/fuzzer-preauth.c	['fuzzer-preauth']	[]
/src/dropbear/libtommath/bn_mp_dr_setup.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_reduce.c	[]	[]
/src/dropbear/libtommath/bn_mp_div_2.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/sntrup761.c	[]	[]
/src/dropbear/libtommath/bn_mp_cmp.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_read_radix.c	['fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_div_d.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_exch.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_submod.c	[]	[]
/src/dropbear/src/listener.c	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k_setup.c	['fuzzer-kexdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/chachapoly.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_points.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_size.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/libtommath/bn_s_mp_mul_digs.c	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-cliconf.c	['fuzzer-cliconf']	[]
/src/dropbear/libtommath/bn_mp_is_square.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_map.c	[]	[]
/src/dropbear/libtommath/bn_mp_to_radix.c	[]	[]
/src/dropbear/src/mlkem768.c	[]	[]
/src/dropbear/libtommath/bn_mp_sqrt.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/common-kex.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/src/svr-chansession.c	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']	['fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth']
/src/dropbear/libtommath/bn_mp_dr_reduce.c	[]	[]
/src/dropbear/src/curve25519.c	['fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']
/src/dropbear/src/cli-kex.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_clear.c	['fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexecdh', 'fuzzer-cliconf', 'fuzzer-verify', 'fuzzer-kexmlkem-cli', 'fuzzer-kexcurve25519', 'fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']	['fuzzer-kexdh', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexmlkem-srv', 'fuzzer-kexsntrup-srv']

Directories in report

Directory
/src/dropbear/libtomcrypt/src/misc/crypt/
/src/dropbear/libtomcrypt/src/mac/hmac/
/src/dropbear/src/
/src/dropbear/libtomcrypt/src/hashes/
/src/dropbear/libtomcrypt/src/modes/ctr/
/src/dropbear/libtomcrypt/src/hashes/helper/
/src/dropbear/src/../fuzz/
/src/dropbear/libtomcrypt/src/mac/poly1305/
/src/dropbear/libtomcrypt/src/hashes/sha2/
/usr/include/x86_64-linux-gnu/bits/
/src/dropbear/libtomcrypt/src/ciphers/aes/
/src/dropbear/libtomcrypt/src/pk/ecc/
/src/dropbear/libtomcrypt/src/misc/
/src/dropbear/libtomcrypt/src/math/
/src/dropbear/libtommath/
/src/dropbear/libtomcrypt/src/headers/
/src/dropbear/libtomcrypt/src/misc/base64/
/src/dropbear/libtomcrypt/src/stream/chacha/