High level conclusions

Fuzzers reach 78.66% code coverage.

Fuzzers reach 51.08% of cyclomatic complexity.

Fuzzers reach 39.37% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

476 / 1209

Cyclomatic complexity statically reachable by fuzzers

3161 / 6188

Runtime code coverage of functions

951 / 1209

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzzer-pubkey

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	124	40.1%
gold	[1:9]	20	6.47%
yellow	[10:29]	3	0.97%
greenyellow	[30:49]	5	1.61%
lawngreen	50+	157	50.8%
All colors	309	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
35	62	buf_getptr	call site: 00062	write_urandom
23	38	sha256_done	call site: 00038	seedrandom
14	193	cmp_base64_key	call site: 00193	sign_key_fingerprint
10	270	svr_parse_pubkey_options	call site: 00270	list_append
5	29	sha256_init	call site: 00029	sha256_process
5	127	buf_new	call site: 00127	buf_putint
4	292	svr_pubkey_options_cleanup	call site: 00292	list_remove
3	15	register_cipher	call site: 00015	fprintf
3	25	crypto_init	call site: 00025	genrandom
1	6	fuzz_common_setup	call site: 00006	dropbear_exit
1	8	m_malloc	call site: 00008	dropbear_exit
1	20	register_hash	call site: 00020	dropbear_exit

Runtime coverage analysis

Covered functions

62

Functions that are reachable but not covered

50

Reachable functions

109

Percentage of reachable functions covered

54.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-pubkey.c	2
src/../fuzz/fuzz-common.c	2
src/dbutil.c	4
src/dbmalloc.c	8
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	17
src/dbhelpers.c	1
src/ecc.c	1
src/signkey.c	5
src/svr-authpubkey.c	2
libtomcrypt/src/misc/base64/base64_decode.c	2
libtomcrypt/src/misc/base64/base64_encode.c	2
src/svr-authpubkeyoptions.c	3
src/list.c	3
src/common-runopts.c	1

Fuzzer: fuzzer-cliconf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	601	77.5%
gold	[1:9]	49	6.32%
yellow	[10:29]	1	0.12%
greenyellow	[30:49]	2	0.25%
lawngreen	50+	122	15.7%
All colors	775	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
166	339	buf_getbyte	call site: 00339	ecc_is_point
105	217	m_free_direct	call site: 00217	buf_get_ecdsa_priv_key
45	573	buf_putbyte	call site: 00573	algolist_string
41	122	m_strdup	call site: 00122	add_extendedopt
41	523	loadidentityfile	call site: 00523	loadidentityfile
23	74	wrapfd_close	call site: 00074	write_urandom
23	718	parse_multihop_hostname	call site: 00718	multihop_args
17	677	cli_getopts	call site: 00677	split_address_port
15	38	sha256_done	call site: 00038	seedrandom
14	191	m_close	call site: 00191	buf_get_priv_key
11	62	buf_getptr	call site: 00062	sha256_process
11	695	cli_getopts	call site: 00695	parse_recv_window

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

143

Reachable functions

210

Percentage of reachable functions covered

31.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-cliconf.c	2
src/../fuzz/fuzz-common.c	3
src/dbutil.c	11
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	7
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	21
src/dbhelpers.c	1
src/ecc.c	4
src/cli-runopts.c	13
src/list.c	2
src/common-runopts.c	6
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/common-algo.c	5
src/cli-readconf.c	1
src/compat.c	1

Fuzzer: fuzzer-kexsntrup-cli

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	178	55.2%
gold	[1:9]	31	9.62%
yellow	[10:29]	3	0.93%
greenyellow	[30:49]	7	2.17%
lawngreen	50+	103	31.9%
All colors	322	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
49	206	fail_assert	call site: 00206	buf_putmpint
27	65	buf_getptr	call site: 00065	write_urandom
27	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
23	41	genrandom	call site: 00041	seedrandom
10	296	kexpqhybrid_comb_key	call site: 00296	buf_newcopy
6	309	LLVMFuzzerTestOneInput	call site: 00309	free_kexcurve25519_param
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
3	93	genrandom	call site: 00093	explicit_bzero
3	257	buf_put_rsa_pub_key	call site: 00257	buf_putmpint
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

66

Reachable functions

119

Percentage of reachable functions covered

44.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexsntrup-cli.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexsntrup-srv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	45.8%
gold	[1:9]	51	15.7%
yellow	[10:29]	2	0.61%
greenyellow	[30:49]	15	4.64%
lawngreen	50+	107	33.1%
All colors	323	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
27	65	buf_getptr	call site: 00065	write_urandom
23	41	genrandom	call site: 00041	seedrandom
22	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
12	209	buf_putstring	call site: 00209	buf_putmpint
11	249	mp_div_2d	call site: 00249	buf_put_rsa_pub_key
7	241	mp_div_2d	call site: 00241	mp_mod_2d
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
4	203	buf_put_pub_key	call site: 00203	buf_put_dss_pub_key
3	93	genrandom	call site: 00093	explicit_bzero
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

44

Reachable functions

119

Percentage of reachable functions covered

63.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexsntrup-srv.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexcurve25519

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	79	33.7%
gold	[1:9]	1	0.42%
yellow	[10:29]	1	0.42%
greenyellow	[30:49]	10	4.27%
lawngreen	50+	143	61.1%
All colors	234	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
22	178	buf_put_pub_key	call site: 00178	buf_put_ecdsa_pub_key
8	169	buf_putmpint	call site: 00169	buf_put_rsa_pub_key
6	159	mp_div_2d	call site: 00159	mp_mod_2d
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	128	buf_put_pub_key	call site: 00128	buf_put_dss_pub_key
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress
2	117	mp_from_ubin	call site: 00117	mp_copy
1	21	sha256_done	call site: 00021	sha256_compress
1	29	buf_getint	call site: 00029	dropbear_exit
1	35	buf_getstringbuf_int	call site: 00035	dropbear_exit
1	37	buf_new	call site: 00037	dropbear_exit

Runtime coverage analysis

Covered functions

140

Functions that are reachable but not covered

23

Reachable functions

101

Percentage of reachable functions covered

77.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexcurve25519.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	20
src/dbutil.c	3
src/kex-x25519.c	2
src/curve25519.c	10
src/bignum.c	2
libtommath/bn_mp_init.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
src/dbhelpers.c	1
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexmlkem-cli

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	178	55.2%
gold	[1:9]	10	3.10%
yellow	[10:29]	24	7.45%
greenyellow	[30:49]	4	1.24%
lawngreen	50+	106	32.9%
All colors	322	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
49	206	fail_assert	call site: 00206	buf_putmpint
27	65	buf_getptr	call site: 00065	write_urandom
27	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
23	41	genrandom	call site: 00041	seedrandom
10	296	kexpqhybrid_comb_key	call site: 00296	buf_newcopy
6	309	LLVMFuzzerTestOneInput	call site: 00309	free_kexcurve25519_param
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
3	93	genrandom	call site: 00093	explicit_bzero
3	257	buf_put_rsa_pub_key	call site: 00257	buf_putmpint
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

418

Functions that are reachable but not covered

66

Reachable functions

119

Percentage of reachable functions covered

44.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexmlkem-cli.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexmlkem-srv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	45.8%
gold	[1:9]	5	1.54%
yellow	[10:29]	42	13.0%
greenyellow	[30:49]	16	4.95%
lawngreen	50+	112	34.6%
All colors	323	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
27	65	buf_getptr	call site: 00065	write_urandom
23	41	genrandom	call site: 00041	seedrandom
22	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
12	209	buf_putstring	call site: 00209	buf_putmpint
11	249	mp_div_2d	call site: 00249	buf_put_rsa_pub_key
7	241	mp_div_2d	call site: 00241	mp_mod_2d
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
4	203	buf_put_pub_key	call site: 00203	buf_put_dss_pub_key
3	93	genrandom	call site: 00093	explicit_bzero
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

463

Functions that are reachable but not covered

44

Reachable functions

119

Percentage of reachable functions covered

63.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexmlkem-srv.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-preauth_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	516	48.0%
gold	[1:9]	200	18.6%
yellow	[10:29]	11	1.02%
greenyellow	[30:49]	2	0.18%
lawngreen	50+	345	32.1%
All colors	1074	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	966	session_loop	call site: 00966	check_close
42	778	session_loop	call site: 00778	connect_try_next
29	178	m_close	call site: 00178	parse_recv_window
23	125	m_strdup	call site: 00125	addportandaddress
23	846	checktimeouts	call site: 00846	send_msg_kexinit
20	74	wrapfd_remove	call site: 00074	write_urandom
16	39	sha256_done	call site: 00039	seedrandom
16	599	fuzz_get_socket_address	call site: 00599	getaddrstring
14	208	svr_getopts	call site: 00208	print_algos
11	483	s_mp_mul_digs_fast	call site: 00483	mp_mul
10	470	ecc_is_point	call site: 00470	s_mp_balance_mul
9	166	buf_new	call site: 00166	buf_readfile

Runtime coverage analysis

Covered functions

261

Functions that are reachable but not covered

121

Reachable functions

305

Percentage of reachable functions covered

60.33%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-preauth_nomaths.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	15
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	4
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	4
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-preauth

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	501	46.6%
gold	[1:9]	165	15.3%
yellow	[10:29]	3	0.27%
greenyellow	[30:49]	1	0.09%
lawngreen	50+	404	37.6%
All colors	1074	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	966	session_loop	call site: 00966	check_close
42	778	session_loop	call site: 00778	connect_try_next
29	178	m_close	call site: 00178	parse_recv_window
23	125	m_strdup	call site: 00125	addportandaddress
23	846	checktimeouts	call site: 00846	send_msg_kexinit
20	74	wrapfd_remove	call site: 00074	write_urandom
16	39	sha256_done	call site: 00039	seedrandom
16	599	fuzz_get_socket_address	call site: 00599	getaddrstring
14	208	svr_getopts	call site: 00208	print_algos
11	483	s_mp_mul_digs_fast	call site: 00483	mp_mul
9	166	buf_new	call site: 00166	buf_readfile
7	150	m_free_direct	call site: 00150	addhostkey

Runtime coverage analysis

Covered functions

342

Functions that are reachable but not covered

117

Reachable functions

305

Percentage of reachable functions covered

61.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-preauth.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	15
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	4
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	4
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-kexdh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	217	49.2%
gold	[1:9]	3	0.68%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.68%
lawngreen	50+	218	49.4%
All colors	441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
36	196	mp_clear_multi	call site: 00196	mp_exptmod
23	274	s_mp_mul_digs_fast	call site: 00274	mp_mul
16	179	mp_div_2	call site: 00179	mp_sub
14	257	s_mp_sqr_fast	call site: 00257	mp_mul
10	244	mp_2expt	call site: 00244	mp_mod
9	233	mp_exptmod	call site: 00233	s_mp_exptmod
8	374	buf_putmpint	call site: 00374	buf_put_rsa_pub_key
6	103	m_free_direct	call site: 00103	mp_invmod
6	158	mp_div_2d	call site: 00158	mp_mod_2d
6	307	s_mp_exptmod_fast	call site: 00307	mp_reduce_2k_setup
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
5	150	mp_add	call site: 00150	s_mp_sub

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

31

Reachable functions

134

Percentage of reachable functions covered

76.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexdh.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	19
src/dbutil.c	2
src/bignum.c	4
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
src/kex-dh.c	2
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_clear_multi.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/dbhelpers.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-client_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1605	78.0%
gold	[1:9]	114	5.54%
yellow	[10:29]	3	0.14%
greenyellow	[30:49]	1	0.04%
lawngreen	50+	334	16.2%
All colors	2057	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
309	1597	buf_has_algo	call site: 01597	send_msg_userauth_pubkey
277	1223	cli_sessionloop	call site: 01223	gen_kexdh_param
153	340	buf_getbyte	call site: 00340	ecc_is_point
99	1910	cbuf_new	call site: 01910	setup_localtcp
75	1512	cli_auth_getmethods	call site: 01512	cli_auth_try
62	1119	session_loop	call site: 01119	check_close
51	256	m_realloc	call site: 00256	buf_get_rsa_priv_key
42	632	parse_hostname	call site: 00632	read_config_file
42	931	session_loop	call site: 00931	connect_try_next
41	123	m_strdup	call site: 00123	add_extendedopt
39	526	list_append	call site: 00526	loadidentityfile
38	581	buf_put_algolist_all	call site: 00581	algolist_string

Runtime coverage analysis

Covered functions

201

Functions that are reachable but not covered

319

Reachable functions

474

Percentage of reachable functions covered

32.7%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-client_nomaths.c	1
src/../fuzz/fuzz-common.c	8
src/dbutil.c	18
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	8
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	26
src/dbhelpers.c	1
src/ecc.c	6
src/cli-runopts.c	13
src/list.c	3
src/common-runopts.c	6
src/signkey.c	12
src/dss.c	5
src/bignum.c	5
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	6
src/ecdsa.c	5
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	5
src/common-algo.c	8
src/cli-readconf.c	1
src/compat.c	2
src/cli-session.c	6
src/common-session.c	13
src/netio.c	13
src/queue.c	5
src/common-channel.c	18
src/listener.c	6
src/packet.c	11
src/common-kex.c	4
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	6
src/atomicio.c	1
src/process-packet.c	2
src/cli-kex.c	2
src/kex-dh.c	3
src/kex-ecdh.c	2
src/kex-x25519.c	2
src/kex-pqhybrid.c	2
libtommath/bn_mp_set_ul.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ecc_make_key.c	1
libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
src/curve25519.c	21
src/cli-auth.c	3
src/cli-authpubkey.c	3
src/cli-agentfwd.c	5
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_addmod.c	1
libtommath/bn_mp_set_u64.c	1
libtomcrypt/src/hashes/sha2/sha512.c	4
src/cli-authinteract.c	1
src/cli-authpasswd.c	1
src/cli-chansession.c	4
src/cli-tcpfwd.c	5
src/tcp-accept.c	3

Fuzzer: fuzzer-postauth_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	440	40.9%
gold	[1:9]	194	18.0%
yellow	[10:29]	24	2.23%
greenyellow	[30:49]	1	0.09%
lawngreen	50+	415	38.6%
All colors	1074	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
31	778	session_loop	call site: 00778	connect_try_next
29	178	m_close	call site: 00178	parse_recv_window
23	125	m_strdup	call site: 00125	addportandaddress
23	846	checktimeouts	call site: 00846	send_msg_kexinit
20	74	wrapfd_remove	call site: 00074	write_urandom
16	39	sha256_done	call site: 00039	seedrandom
16	599	fuzz_get_socket_address	call site: 00599	getaddrstring
14	208	svr_getopts	call site: 00208	print_algos
11	483	s_mp_mul_digs_fast	call site: 00483	mp_mul
10	470	ecc_is_point	call site: 00470	s_mp_balance_mul
9	166	buf_new	call site: 00166	buf_readfile
7	150	m_free_direct	call site: 00150	addhostkey

Runtime coverage analysis

Covered functions

354

Functions that are reachable but not covered

103

Reachable functions

305

Percentage of reachable functions covered

66.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-postauth_nomaths.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	15
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	4
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	4
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1079	52.4%
gold	[1:9]	116	5.63%
yellow	[10:29]	19	0.92%
greenyellow	[30:49]	13	0.63%
lawngreen	50+	830	40.3%
All colors	2057	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
156	1853	par25519	call site: 01853	setup_localtcp
81	1119	session_loop	call site: 01119	check_close
60	1739	rsa_pad_em	call site: 01739	mp_exptmod
43	1512	cli_auth_getmethods	call site: 01512	cli_auth_try
42	632	parse_hostname	call site: 00632	read_config_file
42	931	session_loop	call site: 00931	connect_try_next
41	123	m_strdup	call site: 00123	add_extendedopt
39	526	list_append	call site: 00526	loadidentityfile
39	1686	sha1_done	call site: 01686	buf_put_rsa_sign
38	581	buf_put_algolist_all	call site: 00581	algolist_string
26	996	checktimeouts	call site: 00996	send_msg_kexinit
26	1650	buf_put_pub_key	call site: 01650	cli_buf_put_sign

Runtime coverage analysis

Covered functions

638

Functions that are reachable but not covered

189

Reachable functions

474

Percentage of reachable functions covered

60.13%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-client.c	1
src/../fuzz/fuzz-common.c	8
src/dbutil.c	18
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	8
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	26
src/dbhelpers.c	1
src/ecc.c	6
src/cli-runopts.c	13
src/list.c	3
src/common-runopts.c	6
src/signkey.c	12
src/dss.c	5
src/bignum.c	5
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	6
src/ecdsa.c	5
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	5
src/common-algo.c	8
src/cli-readconf.c	1
src/compat.c	2
src/cli-session.c	6
src/common-session.c	13
src/netio.c	13
src/queue.c	5
src/common-channel.c	18
src/listener.c	6
src/packet.c	11
src/common-kex.c	4
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	6
src/atomicio.c	1
src/process-packet.c	2
src/cli-kex.c	2
src/kex-dh.c	3
src/kex-ecdh.c	2
src/kex-x25519.c	2
src/kex-pqhybrid.c	2
libtommath/bn_mp_set_ul.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ecc_make_key.c	1
libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
src/curve25519.c	21
src/cli-auth.c	3
src/cli-authpubkey.c	3
src/cli-agentfwd.c	5
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_addmod.c	1
libtommath/bn_mp_set_u64.c	1
libtomcrypt/src/hashes/sha2/sha512.c	4
src/cli-authinteract.c	1
src/cli-authpasswd.c	1
src/cli-chansession.c	4
src/cli-tcpfwd.c	5
src/tcp-accept.c	3

Fuzzer: fuzzer-kexecdh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	29.7%
gold	[1:9]	3	0.84%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.56%
lawngreen	50+	243	68.8%
All colors	353	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	207	s_mp_mul_digs_fast	call site: 00207	mp_mul
8	286	buf_putmpint	call site: 00286	buf_put_rsa_pub_key
6	177	mp_div_2d	call site: 00177	mp_mod_2d
6	198	mp_init_multi	call site: 00198	mp_mul
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
5	318	buf_put_ecc_raw_pubkey_string	call site: 00318	buf_put_ed25519_pub_key
4	105	mp_read_radix	call site: 00105	mp_sub_d
4	262	buf_put_pub_key	call site: 00262	buf_put_dss_pub_key
3	120	mp_init_size	call site: 00120	mp_clear
3	194	ecc_is_point	call site: 00194	s_mp_balance_mul
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

22

Reachable functions

124

Percentage of reachable functions covered

82.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexecdh.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	21
src/dbutil.c	3
src/kex-ecdh.c	1
src/ecc.c	6
src/bignum.c	2
libtommath/bn_mp_init.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_cmp_mag.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
libtommath/bn_mp_cmp_d.c	1
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
src/rsa.c	1
src/ecdsa.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/dbhelpers.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-verify

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	204	22.2%
gold	[1:9]	39	4.25%
yellow	[10:29]	33	3.59%
greenyellow	[30:49]	35	3.81%
lawngreen	50+	606	66.0%
All colors	917	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
31	62	buf_getptr	call site: 00062	write_urandom
23	38	sha256_done	call site: 00038	seedrandom
22	768	dropbear_ed25519_verify	call site: 00768	buf_sk_ecdsa_verify
9	371	s_mp_mul_digs	call site: 00371	mp_mul
6	360	mp_init_multi	call site: 00360	mp_mul
6	523	buf_dss_verify	call site: 00523	mp_exptmod
6	574	s_mp_exptmod_fast	call site: 00574	mp_reduce_2k_setup
6	877	mp_prime_is_prime	call site: 00877	mp_prime_miller_rabin
4	273	mp_read_radix	call site: 00273	mp_sub_d
3	15	register_cipher	call site: 00015	fprintf
3	94	genrandom	call site: 00094	explicit_bzero
3	356	ecc_is_point	call site: 00356	s_mp_balance_mul

Runtime coverage analysis

Covered functions

238

Functions that are reachable but not covered

45

Reachable functions

243

Percentage of reachable functions covered

81.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-verify.c	2
src/../fuzz/fuzz-common.c	2
src/dbutil.c	4
src/dbmalloc.c	11
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	2
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	20
src/dbhelpers.c	1
src/ecc.c	5
src/signkey.c	9
src/dss.c	3
src/bignum.c	4
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	4
src/ecdsa.c	4
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	3
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
src/curve25519.c	26
libtomcrypt/src/hashes/sha2/sha512.c	4
src/sk-ecdsa.c	1
src/sk-ed25519.c	1
libtommath/bn_mp_prime_rabin_miller_trials.c	1
libtommath/bn_mp_prime_is_prime.c	2
libtommath/bn_mp_is_square.c	1
libtommath/bn_mp_mod_d.c	1
libtommath/bn_mp_div_d.c	1
libtommath/bn_mp_div_3.c	1
libtommath/bn_mp_init_u32.c	1
libtommath/bn_mp_set_u32.c	1
libtommath/bn_mp_get_i32.c	1
libtommath/bn_mp_get_mag_u32.c	1
libtommath/bn_mp_sqrt.c	1
libtommath/bn_s_mp_prime_is_divisible.c	1
libtommath/bn_mp_init_set.c	1
libtommath/bn_mp_prime_miller_rabin.c	1
libtommath/bn_mp_cnt_lsb.c	1
libtommath/bn_mp_sqrmod.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
crypto_kem_mlkem768_dec	/src/dropbear/src/mlkem768.c	3	['N/A', 'N/A', 'N/A']	16	0	31	3	2	311	0	743	737
chansessionrequest	/src/dropbear/src/svr-chansession.c	1	['N/A']	13	0	179	39	12	214	0	843	356
send_msg_kexdh_reply	/src/dropbear/src/svr-kex.c	2	['N/A', 'N/A']	14	0	148	18	4	322	1	2029	168
ltc_ecc_projective_add_point	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	3	0	1362	209	86	6	0	163	146
crypto_kem_sntrup761_dec	/src/dropbear/src/sntrup761.c	3	['N/A', 'N/A', 'N/A']	7	0	93	7	3	39	0	147	114
svr_auth_pubkey	/src/dropbear/src/svr-authpubkey.c	1	['int']	13	0	401	57	19	274	1	1744	90
crypto_kem_sntrup761_keypair	/src/dropbear/src/sntrup761.c	2	['N/A', 'N/A']	14	0	54	7	3	62	0	275	83
crypto_kem_mlkem768_keypair	/src/dropbear/src/mlkem768.c	2	['N/A', 'N/A']	16	0	36	3	2	273	0	702	65
ltc_ecc_mul2add	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mul2add.c	6	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	4	0	864	132	42	17	0	103	56
dropbear_chachapoly_crypt	/src/dropbear/src/chachapoly.c	7	['int', 'N/A', 'N/A', 'size_t', 'size_t', 'N/A', 'int']	4	0	173	25	10	13	0	62	52

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

969 / 1209

Cyclomatic complexity statically reachable by fuzzers

4962 / 6188

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

src/../fuzz/fuzzer-pubkey.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'sha256_done', 'cmp_base64_key', 'svr_parse_pubkey_options', 'sha256_init', 'buf_new', 'svr_pubkey_options_cleanup', 'register_cipher', 'crypto_init', 'fuzz_common_setup']

src/../fuzz/fuzzer-cliconf.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getbyte', 'm_free_direct', 'buf_putbyte', 'm_strdup', 'loadidentityfile', 'wrapfd_close', 'parse_multihop_hostname', 'cli_getopts', 'sha256_done', 'm_close']

src/../fuzz/fuzzer-kexsntrup-cli.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['fail_assert', 'buf_getptr', 'buf_put_pub_key', 'genrandom', 'kexpqhybrid_comb_key', 'LLVMFuzzerTestOneInput', 'fuzz_set_input', 'buf_put_rsa_pub_key']

src/../fuzz/fuzzer-kexsntrup-srv.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'genrandom', 'buf_put_pub_key', 'buf_putstring', 'mp_div_2d', 'fuzz_set_input', 'kexpqhybrid_comb_key']

src/../fuzz/fuzzer-kexcurve25519.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_put_pub_key', 'buf_putmpint', 'mp_div_2d', 'fuzz_set_input', 'sha256_init', 'fuzz_seed', 'mp_from_ubin', 'sha256_done', 'buf_getint']

src/../fuzz/fuzzer-kexmlkem-cli.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['fail_assert', 'buf_getptr', 'buf_put_pub_key', 'genrandom', 'kexpqhybrid_comb_key', 'LLVMFuzzerTestOneInput', 'fuzz_set_input', 'buf_put_rsa_pub_key']

src/../fuzz/fuzzer-kexmlkem-srv.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'genrandom', 'buf_put_pub_key', 'buf_putstring', 'mp_div_2d', 'fuzz_set_input', 'kexpqhybrid_comb_key']

src/../fuzz/fuzzer-preauth_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_close', 'm_strdup', 'checktimeouts', 'wrapfd_remove', 'sha256_done', 'fuzz_get_socket_address', 'svr_getopts', 's_mp_mul_digs_fast']

src/../fuzz/fuzzer-preauth.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_close', 'm_strdup', 'checktimeouts', 'wrapfd_remove', 'sha256_done', 'fuzz_get_socket_address', 'svr_getopts', 's_mp_mul_digs_fast']

src/../fuzz/fuzzer-kexdh.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['mp_clear_multi', 's_mp_mul_digs_fast', 'mp_div_2', 's_mp_sqr_fast', 'mp_2expt', 'mp_exptmod', 'buf_putmpint', 'm_free_direct', 'mp_div_2d', 's_mp_exptmod_fast']

src/../fuzz/fuzzer-client_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_has_algo', 'cli_sessionloop', 'buf_getbyte', 'cbuf_new', 'cli_auth_getmethods', 'session_loop', 'm_realloc', 'parse_hostname', 'm_strdup']

src/../fuzz/fuzzer-postauth_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_close', 'm_strdup', 'checktimeouts', 'wrapfd_remove', 'sha256_done', 'fuzz_get_socket_address', 'svr_getopts', 's_mp_mul_digs_fast', 'ecc_is_point']

src/../fuzz/fuzzer-client.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['par25519', 'session_loop', 'rsa_pad_em', 'cli_auth_getmethods', 'parse_hostname', 'm_strdup', 'list_append', 'sha1_done', 'buf_put_algolist_all']

src/../fuzz/fuzzer-kexecdh.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['s_mp_mul_digs_fast', 'buf_putmpint', 'mp_div_2d', 'mp_init_multi', 'fuzz_set_input', 'buf_put_ecc_raw_pubkey_string', 'mp_read_radix', 'buf_put_pub_key', 'mp_init_size', 'ecc_is_point']

src/../fuzz/fuzzer-verify.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'sha256_done', 'dropbear_ed25519_verify', 's_mp_mul_digs', 'mp_init_multi', 'buf_dss_verify', 's_mp_exptmod_fast', 'mp_prime_is_prime', 'mp_read_radix', 'register_cipher']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
cli_getopts	360	163	45.27%	['fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-cliconf', 'fuzzer-kexmlkem-cli', 'fuzzer-kexsntrup-cli']
parse_multihop_hostname	33	16	48.48%	['fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-cliconf', 'fuzzer-kexmlkem-cli', 'fuzzer-kexsntrup-cli']
signkey_key_ptr	37	16	43.24%	['fuzzer-kexmlkem-srv', 'fuzzer-postauth_nomaths', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexsntrup-srv', 'fuzzer-verify', 'fuzzer-kexcurve25519', 'fuzzer-cliconf', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-cli', 'fuzzer-preauth']
svr_getopts	281	87	30.96%	['fuzzer-kexmlkem-srv', 'fuzzer-postauth_nomaths', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-srv', 'fuzzer-preauth_nomaths', 'fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-preauth']
libcrux_sha3_generic_keccak_keccak_e9	61	20	32.78%	['fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-client']
libcrux_sha3_generic_keccak_keccak_e91	61	29	47.54%	['fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-client']
libcrux_sha3_generic_keccak_keccak_e90	61	29	47.54%	['fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-client']
ctr_encrypt	38	14	36.84%	['fuzzer-postauth_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-preauth']
ctr_start	44	22	50.0%	['fuzzer-postauth_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-preauth']
checktimeouts	40	16	40.0%	['fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-preauth_nomaths', 'fuzzer-preauth']
set_sock_priority	40	8	20.0%	['fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-preauth_nomaths', 'fuzzer-preauth']
write_packet	33	18	54.54%	['fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-preauth_nomaths', 'fuzzer-preauth']
svr_auth_password	64	30	46.87%	['fuzzer-preauth_nomaths', 'fuzzer-preauth']
svr_auth_pubkey	119	55	46.21%	['fuzzer-preauth_nomaths', 'fuzzer-preauth']
svr_chansess_checksignal	35	6	17.14%	['fuzzer-postauth_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-preauth']
mp_exptmod	41	18	43.90%	['fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-preauth']
mp_montgomery_reduce	45	10	22.22%	['fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth']
cli_sessionloop	91	33	36.26%	['fuzzer-client', 'fuzzer-client_nomaths']
spawn_command	68	11	16.17%	['fuzzer-postauth_nomaths']
connect_remote	40	18	45.0%	['fuzzer-postauth_nomaths']
connect_streamlocal	34	16	47.05%	['fuzzer-postauth_nomaths']
dropbear_listen	117	13	11.11%	['fuzzer-client', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths']
pty_setowner	45	14	31.11%	['fuzzer-postauth_nomaths']
svr_agentreq	39	17	43.58%	['fuzzer-postauth_nomaths']
ptycommand	80	14	17.5%	['fuzzer-postauth_nomaths']
get_termmodes	66	14	21.21%	['fuzzer-postauth_nomaths']
mp_reduce	52	26	50.0%	['fuzzer-client', 'fuzzer-verify']
s_mp_mul_digs	41	12	29.26%	['fuzzer-postauth_nomaths', 'fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify', 'fuzzer-cliconf', 'fuzzer-kexdh', 'fuzzer-preauth_nomaths', 'fuzzer-preauth']
s_mp_mul_high_digs	40	13	32.5%	['fuzzer-client', 'fuzzer-verify']
buf_ecdsa_verify	98	53	54.08%	['fuzzer-client', 'fuzzer-verify']
mp_prime_is_prime	128	59	46.09%	['fuzzer-verify']
mp_sqrt	44	23	52.27%	['fuzzer-verify']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/dropbear/src/process-packet.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_free.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_2expt.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_sqr.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_init_u32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_div_2d.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_ivctr64.c	[]	[]
/src/dropbear/src/tcp-accept.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_crypt.c	[]	[]
/src/dropbear/libtommath/bn_mp_sqrmod.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/dbmalloc.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_mul_digs_fast.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_hash.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/hashes/sha2/sha384.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_add.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_submod.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_points.c	['fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_to_ubin.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexecdh']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-client', 'fuzzer-kexecdh']
/src/dropbear/src/libcrux_mlkem768_sha3.h	[]	[]
/src/dropbear/src/../fuzz/fuzz-sshpacketmutator.c	[]	[]
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_keystream.c	[]	[]
/src/dropbear/libtommath/bn_mp_init.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/dbutil.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	[]	[]
/src/dropbear/libtommath/bn_s_mp_balance_mul.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	[]
/src/dropbear/src/compat.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-preauth_nomaths.c	['fuzzer-preauth_nomaths']	[]
/src/dropbear/libtommath/bn_mp_set_ul.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtomcrypt/src/mac/poly1305/poly1305.c	[]	[]
/src/dropbear/src/cli-tcpfwd.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_find_hash.c	[]	[]
/src/dropbear/libtommath/bn_mp_lshd.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/cli-runopts.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/atomicio.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/curve25519.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/src/svr-authpubkeyoptions.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/libtommath/bn_mp_get_mag_ul.c	[]	[]
/src/dropbear/src/../fuzz/fuzzer-kexmlkem-srv.c	['fuzzer-kexmlkem-srv']	[]
/src/dropbear/src/loginrec.c	[]	[]
/src/dropbear/src/netio.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_clamp.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/dss.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_set.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_sqrt.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-postauth_nomaths.c	['fuzzer-postauth_nomaths']	[]
/src/dropbear/src/signkey.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_lcm.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexecdh']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-kexecdh']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_setup.c	[]	[]
/src/dropbear/src/crypto_desc.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/src/svr-runopts.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/src/gened25519.c	[]	[]
/src/dropbear/src/bignum.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/cli-authpubkey.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/src/sk-ed25519.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/common-algo.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/sha1.c	['fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_sub.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_init_copy.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c	[]	[]
/src/dropbear/libtommath/bn_mp_to_radix.c	[]	[]
/src/dropbear/src/sshpty.c	[]	[]
/src/dropbear/src/svr-session.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_from_ubin.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_init_multi.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_mul.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_reduce_setup.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_abs.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	[]
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_init.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtomcrypt/src/hashes/sha2/sha256.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/../fuzz/fuzz-wrapfd.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	[]
/src/dropbear/src/cli-agentfwd.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/libtommath/bn_mp_neg.c	[]	[]
/src/dropbear/src/queue.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_add_d.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/sntrup761_compat.h	[]	[]
/src/dropbear/libtommath/bn_mp_get_l.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_cipher_is_valid.c	[]	[]
/src/dropbear/src/svr-authpubkey.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_encrypt.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_montgomery_reduce_fast.c	[]	[]
/src/dropbear/libtommath/bn_mp_is_square.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-kexsntrup-srv.c	['fuzzer-kexsntrup-srv']	[]
/src/dropbear/libtommath/bn_mp_addmod.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/../fuzz/fuzzer-verify.c	['fuzzer-verify']	[]
/src/dropbear/src/ed25519.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_div_d.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-kexmlkem-cli.c	['fuzzer-kexmlkem-cli']	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_map.c	[]	[]
/src/dropbear/libtomcrypt/src/hashes/sha2/sha512.c	['fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-kexdh.c	['fuzzer-kexdh']	[]
/src/dropbear/src/kex-pqhybrid.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cmp.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/buffer.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_mulmod.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_dr_setup.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	[]
/src/dropbear/libtommath/bn_mp_reduce_2k_setup_l.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/src/svr-streamfwd.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/src/svr-auth.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_mul_d.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_exptmod_fast.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_reduce_2k_setup.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	[]
/src/dropbear/libtommath/bn_mp_exch.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/ltc_prng.c	[]	[]
/src/dropbear/src/cli-auth.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_make_key.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/helper/hash_memory.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/../fuzz/fuzzer-client.c	['fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_mod.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_prime_rabin_miller_trials.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/common-channel.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-client_nomaths.c	['fuzzer-client_nomaths']	[]
/src/dropbear/libtommath/bn_mp_reduce_is_2k_l.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_prng.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_clear.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_montgomery_calc_normalization.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_clear_multi.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_mul_2.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_decrypt.c	[]	[]
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_process.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/src/ecdsa.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_set_u64.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_sqr.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_find_cipher.c	[]	[]
/src/dropbear/libtommath/bn_mp_prime_miller_rabin.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_rand.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/src/svr-chansession.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/src/svr-agentfwd.c	[]	[]
/src/dropbear/libtommath/bn_mp_sub_d.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/misc/base64/base64_encode.c	['fuzzer-pubkey']	[]
/src/dropbear/libtomcrypt/src/headers/tomcrypt_macros.h	['fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_get_i32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/list.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_size.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-preauth.c	['fuzzer-preauth']	[]
/src/dropbear/src/gendss.c	[]	[]
/src/dropbear/libtomcrypt/src/math/multi.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/common-runopts.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/cli-authpasswd.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_invmod.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_prime_is_prime.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_reduce_2k.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mulmod_timing.c	[]	[]
/src/dropbear/libtommath/bn_mp_mod_2d.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_reduce.c	[]	[]
/src/dropbear/libtommath/bn_mp_div_3.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/cli-kex.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_grow.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/kex-dh.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/cli-channel.c	[]	[]
/src/dropbear/src/ecc.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/dbhelpers.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_cmp_d.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-kexcurve25519.c	['fuzzer-kexcurve25519']	[]
/src/dropbear/src/svr-authpasswd.c	[]	[]
/src/dropbear/src/listener.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_mul_high_digs_fast.c	[]	[]
/src/dropbear/src/rsa.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_copy.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/../fuzz/fuzz-common.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	[]
/src/dropbear/libtommath/bn_mp_get_mag_u32.c	['fuzzer-verify']	[]
/src/dropbear/src/cli-readconf.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-cliconf']
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_done.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/src/svr-tcpfwd.c	[]	[]
/src/dropbear/libtommath/bn_mp_montgomery_setup.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexecdh']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-kexecdh']
/src/dropbear/libtommath/bn_mp_sub.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/svr-kex.c	[]	[]
/src/dropbear/src/kex-ecdh.c	['fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexecdh']	['fuzzer-client', 'fuzzer-kexecdh']
/src/dropbear/src/svr-forward.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_prime_is_divisible.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtomcrypt/src/math/ltm_desc.c	[]	[]
/src/dropbear/libtommath/bn_mp_mul_2d.c	['fuzzer-cliconf', 'fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexcurve25519', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_read_radix.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/kex-x25519.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-client']
/src/dropbear/src/gensignkey.c	[]	[]
/src/dropbear/libtommath/bn_mp_cnt_lsb.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_exptmod.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_rshd.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/genrsa.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_exptmod.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/src/common-session.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_invmod_fast.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/src/cli-chansession.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cmp_mag.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_reduce_2k_l.c	[]	[]
/src/dropbear/src/common-kex.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh']
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_start.c	[]	[]
/src/dropbear/libtomcrypt/src/ciphers/aes/aes.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_mul_digs.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-cliconf.c	['fuzzer-cliconf']	[]
/src/dropbear/libtommath/bn_mp_div_2.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/src/sk-ecdsa.c	['fuzzer-verify']	[]
/src/dropbear/src/mlkem768.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mul2add.c	[]	[]
/src/dropbear/libtommath/bn_mp_ubin_size.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexcurve25519', 'fuzzer-kexdh', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_reverse.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/base64/base64_decode.c	['fuzzer-pubkey']	['fuzzer-pubkey']
/src/dropbear/src/sntrup761.c	[]	[]
/src/dropbear/libtommath/bn_mp_init_set.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_dr_reduce.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_sqr_fast.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-kexecdh.c	['fuzzer-kexecdh']	[]
/src/dropbear/src/circbuffer.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_prime_next_prime.c	[]	[]
/src/dropbear/src/../fuzz/fuzzer-kexsntrup-cli.c	['fuzzer-kexsntrup-cli']	[]
/src/dropbear/src/cli-session.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_div.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/src/cli-authinteract.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_reduce_is_2k.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_mul_high_digs.c	[]	[]
/src/dropbear/src/../fuzz/fuzzer-pubkey.c	['fuzzer-pubkey']	[]
/src/dropbear/src/dbrandom.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_add.c	['fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_dbl_point.c	[]	[]
/src/dropbear/libtommath/bn_mp_set_u32.c	['fuzzer-verify']	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_argchk.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	[]
/src/dropbear/src/chachapoly.c	[]	[]
/src/dropbear/libtommath/bn_mp_montgomery_reduce.c	[]	[]
/src/dropbear/src/packet.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_gcd.c	[]	[]
/src/dropbear/libtommath/bn_mp_dr_is_modulus.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-kexdh', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/misc/zeromem.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh']
/src/dropbear/src/svr-service.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_invmod_slow.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_count_bits.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_cipher.c	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-verify']	['fuzzer-pubkey', 'fuzzer-cliconf', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_zero.c	['fuzzer-cliconf', 'fuzzer-kexsntrup-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']	['fuzzer-kexsntrup-srv', 'fuzzer-kexcurve25519', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-postauth_nomaths', 'fuzzer-client', 'fuzzer-kexecdh', 'fuzzer-verify']
/src/dropbear/libtommath/bn_mp_mod_d.c	['fuzzer-verify']	['fuzzer-verify']

Directories in report

Directory
/src/dropbear/libtomcrypt/src/hashes/
/src/dropbear/src/
/src/dropbear/libtomcrypt/src/ciphers/aes/
/src/dropbear/libtomcrypt/src/misc/
/src/dropbear/libtomcrypt/src/modes/ctr/
/src/dropbear/libtomcrypt/src/pk/ecc/
/src/dropbear/libtomcrypt/src/misc/crypt/
/src/dropbear/libtomcrypt/src/stream/chacha/
/src/dropbear/libtomcrypt/src/mac/hmac/
/usr/include/x86_64-linux-gnu/bits/
/src/dropbear/libtomcrypt/src/hashes/helper/
/src/dropbear/libtomcrypt/src/hashes/sha2/
/src/dropbear/libtomcrypt/src/headers/
/src/dropbear/libtomcrypt/src/mac/poly1305/
/src/dropbear/libtomcrypt/src/misc/base64/
/src/dropbear/libtommath/
/src/dropbear/libtomcrypt/src/math/
/src/dropbear/src/../fuzz/