High level conclusions

Fuzzers reach 78.26% code coverage.

Fuzzers reach 51.12% of cyclomatic complexity.

Fuzzers reach 39.42% of all functions.

Fuzzer fuzzer-pubkey is blocked:

The runtime code coverage of fuzzer-pubkey covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

477 / 1210

Cyclomatic complexity statically reachable by fuzzers

3171 / 6202

Runtime code coverage of functions

947 / 1210

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: fuzzer-pubkey

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	309	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	309	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
308	0	EP	call site: 00000	fuzz_checkpubkey_line

Runtime coverage analysis

Covered functions

1

Functions that are reachable but not covered

109

Reachable functions

109

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-pubkey.c	2
src/../fuzz/fuzz-common.c	2
src/dbutil.c	4
src/dbmalloc.c	8
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	17
src/dbhelpers.c	1
src/ecc.c	1
src/signkey.c	5
src/svr-authpubkey.c	2
libtomcrypt/src/misc/base64/base64_decode.c	2
libtomcrypt/src/misc/base64/base64_encode.c	2
src/svr-authpubkeyoptions.c	3
src/list.c	3
src/common-runopts.c	1

Fuzzer: fuzzer-kexcurve25519

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	79	33.7%
gold	[1:9]	1	0.42%
yellow	[10:29]	1	0.42%
greenyellow	[30:49]	10	4.27%
lawngreen	50+	143	61.1%
All colors	234	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
22	178	buf_put_pub_key	call site: 00178	buf_put_ecdsa_pub_key
8	169	buf_putmpint	call site: 00169	buf_put_rsa_pub_key
6	159	mp_div_2d	call site: 00159	mp_mod_2d
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	128	buf_put_pub_key	call site: 00128	buf_put_dss_pub_key
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress
2	117	mp_from_ubin	call site: 00117	mp_copy
1	21	sha256_done	call site: 00021	sha256_compress
1	29	buf_getint	call site: 00029	dropbear_exit
1	35	buf_getstringbuf_int	call site: 00035	dropbear_exit
1	37	buf_new	call site: 00037	dropbear_exit

Runtime coverage analysis

Covered functions

140

Functions that are reachable but not covered

23

Reachable functions

101

Percentage of reachable functions covered

77.23%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexcurve25519.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	20
src/dbutil.c	3
src/kex-x25519.c	2
src/curve25519.c	10
src/bignum.c	2
libtommath/bn_mp_init.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
src/dbhelpers.c	1
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexecdh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	105	29.7%
gold	[1:9]	3	0.84%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	2	0.56%
lawngreen	50+	243	68.8%
All colors	353	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
11	207	s_mp_mul_digs_fast	call site: 00207	mp_mul
8	286	buf_putmpint	call site: 00286	buf_put_rsa_pub_key
6	177	mp_div_2d	call site: 00177	mp_mod_2d
6	198	mp_init_multi	call site: 00198	mp_mul
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
5	318	buf_put_ecc_raw_pubkey_string	call site: 00318	buf_put_ed25519_pub_key
4	105	mp_read_radix	call site: 00105	mp_sub_d
4	262	buf_put_pub_key	call site: 00262	buf_put_dss_pub_key
3	120	mp_init_size	call site: 00120	mp_clear
3	194	ecc_is_point	call site: 00194	s_mp_balance_mul
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

189

Functions that are reachable but not covered

22

Reachable functions

124

Percentage of reachable functions covered

82.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexecdh.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	21
src/dbutil.c	3
src/kex-ecdh.c	1
src/ecc.c	6
src/bignum.c	2
libtommath/bn_mp_init.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_cmp_mag.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
libtommath/bn_mp_cmp_d.c	1
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
src/rsa.c	1
src/ecdsa.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/dbhelpers.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexsntrup-cli

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	178	55.2%
gold	[1:9]	30	9.31%
yellow	[10:29]	4	1.24%
greenyellow	[30:49]	7	2.17%
lawngreen	50+	103	31.9%
All colors	322	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
49	206	fail_assert	call site: 00206	buf_putmpint
27	65	buf_getptr	call site: 00065	write_urandom
27	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
23	41	genrandom	call site: 00041	seedrandom
10	296	kexpqhybrid_comb_key	call site: 00296	buf_newcopy
6	309	LLVMFuzzerTestOneInput	call site: 00309	free_kexcurve25519_param
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
3	93	genrandom	call site: 00093	explicit_bzero
3	257	buf_put_rsa_pub_key	call site: 00257	buf_putmpint
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

147

Functions that are reachable but not covered

66

Reachable functions

119

Percentage of reachable functions covered

44.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexsntrup-cli.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-verify

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	204	22.2%
gold	[1:9]	39	4.25%
yellow	[10:29]	32	3.49%
greenyellow	[30:49]	36	3.93%
lawngreen	50+	605	66.0%
All colors	916	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
31	62	buf_getptr	call site: 00062	write_urandom
23	38	sha256_done	call site: 00038	seedrandom
22	767	dropbear_ed25519_verify	call site: 00767	buf_sk_ecdsa_verify
9	370	s_mp_mul_digs	call site: 00370	mp_mul
6	359	mp_init_multi	call site: 00359	mp_mul
6	522	buf_dss_verify	call site: 00522	mp_exptmod
6	573	s_mp_exptmod_fast	call site: 00573	mp_reduce_2k_setup
6	876	mp_prime_is_prime	call site: 00876	mp_prime_miller_rabin
4	272	mp_read_radix	call site: 00272	mp_sub_d
3	15	register_cipher	call site: 00015	fprintf
3	94	genrandom	call site: 00094	explicit_bzero
3	355	ecc_is_point	call site: 00355	s_mp_balance_mul

Runtime coverage analysis

Covered functions

238

Functions that are reachable but not covered

45

Reachable functions

243

Percentage of reachable functions covered

81.48%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-verify.c	2
src/../fuzz/fuzz-common.c	2
src/dbutil.c	4
src/dbmalloc.c	11
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	2
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	20
src/dbhelpers.c	1
src/ecc.c	5
src/signkey.c	9
src/dss.c	3
src/bignum.c	4
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	4
src/ecdsa.c	4
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	3
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
src/curve25519.c	26
libtomcrypt/src/hashes/sha2/sha512.c	4
src/sk-ecdsa.c	1
src/sk-ed25519.c	1
libtommath/bn_mp_prime_rabin_miller_trials.c	1
libtommath/bn_mp_prime_is_prime.c	2
libtommath/bn_mp_is_square.c	1
libtommath/bn_mp_mod_d.c	1
libtommath/bn_mp_div_d.c	1
libtommath/bn_mp_div_3.c	1
libtommath/bn_mp_init_u32.c	1
libtommath/bn_mp_set_u32.c	1
libtommath/bn_mp_get_i32.c	1
libtommath/bn_mp_get_mag_u32.c	1
libtommath/bn_mp_sqrt.c	1
libtommath/bn_s_mp_prime_is_divisible.c	1
libtommath/bn_mp_init_set.c	1
libtommath/bn_mp_prime_miller_rabin.c	1
libtommath/bn_mp_cnt_lsb.c	1
libtommath/bn_mp_sqrmod.c	1

Fuzzer: fuzzer-preauth_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	527	48.4%
gold	[1:9]	199	18.3%
yellow	[10:29]	11	1.01%
greenyellow	[30:49]	3	0.27%
lawngreen	50+	347	31.9%
All colors	1087	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	979	session_loop	call site: 00979	check_close
43	786	session_loop	call site: 00786	connect_try_next
30	178	m_close	call site: 00178	parse_recv_window
23	125	m_strdup	call site: 00125	addportandaddress
23	857	checktimeouts	call site: 00857	send_msg_kexinit
20	74	wrapfd_remove	call site: 00074	write_urandom
16	39	sha256_done	call site: 00039	seedrandom
16	599	fuzz_get_socket_address	call site: 00599	getaddrstring
14	209	svr_getopts	call site: 00209	print_algos
11	483	s_mp_mul_digs_fast	call site: 00483	mp_mul
10	470	ecc_is_point	call site: 00470	s_mp_balance_mul
9	166	buf_new	call site: 00166	buf_readfile

Runtime coverage analysis

Covered functions

262

Functions that are reachable but not covered

121

Reachable functions

306

Percentage of reachable functions covered

60.46%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-preauth_nomaths.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	16
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	4
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	4
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-kexmlkem-srv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	45.8%
gold	[1:9]	25	7.73%
yellow	[10:29]	24	7.43%
greenyellow	[30:49]	16	4.95%
lawngreen	50+	110	34.0%
All colors	323	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
27	65	buf_getptr	call site: 00065	write_urandom
23	41	genrandom	call site: 00041	seedrandom
22	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
12	209	buf_putstring	call site: 00209	buf_putmpint
11	249	mp_div_2d	call site: 00249	buf_put_rsa_pub_key
7	241	mp_div_2d	call site: 00241	mp_mod_2d
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
4	203	buf_put_pub_key	call site: 00203	buf_put_dss_pub_key
3	93	genrandom	call site: 00093	explicit_bzero
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

463

Functions that are reachable but not covered

44

Reachable functions

119

Percentage of reachable functions covered

63.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexmlkem-srv.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-kexmlkem-cli

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	178	55.2%
gold	[1:9]	10	3.10%
yellow	[10:29]	24	7.45%
greenyellow	[30:49]	6	1.86%
lawngreen	50+	104	32.2%
All colors	322	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
49	206	fail_assert	call site: 00206	buf_putmpint
27	65	buf_getptr	call site: 00065	write_urandom
27	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
23	41	genrandom	call site: 00041	seedrandom
10	296	kexpqhybrid_comb_key	call site: 00296	buf_newcopy
6	309	LLVMFuzzerTestOneInput	call site: 00309	free_kexcurve25519_param
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
3	93	genrandom	call site: 00093	explicit_bzero
3	257	buf_put_rsa_pub_key	call site: 00257	buf_putmpint
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

418

Functions that are reachable but not covered

66

Reachable functions

119

Percentage of reachable functions covered

44.54%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexmlkem-cli.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-preauth

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	512	47.1%
gold	[1:9]	163	14.9%
yellow	[10:29]	4	0.36%
greenyellow	[30:49]	1	0.09%
lawngreen	50+	407	37.4%
All colors	1087	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
81	979	session_loop	call site: 00979	check_close
43	786	session_loop	call site: 00786	connect_try_next
30	178	m_close	call site: 00178	parse_recv_window
23	125	m_strdup	call site: 00125	addportandaddress
23	857	checktimeouts	call site: 00857	send_msg_kexinit
20	74	wrapfd_remove	call site: 00074	write_urandom
16	39	sha256_done	call site: 00039	seedrandom
16	599	fuzz_get_socket_address	call site: 00599	getaddrstring
14	209	svr_getopts	call site: 00209	print_algos
11	483	s_mp_mul_digs_fast	call site: 00483	mp_mul
9	166	buf_new	call site: 00166	buf_readfile
7	150	m_free_direct	call site: 00150	addhostkey

Runtime coverage analysis

Covered functions

343

Functions that are reachable but not covered

117

Reachable functions

306

Percentage of reachable functions covered

61.76%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-preauth.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	16
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	4
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	4
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-postauth_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	449	41.3%
gold	[1:9]	193	17.7%
yellow	[10:29]	23	2.11%
greenyellow	[30:49]	2	0.18%
lawngreen	50+	420	38.6%
All colors	1087	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
32	786	session_loop	call site: 00786	connect_try_next
30	178	m_close	call site: 00178	parse_recv_window
23	125	m_strdup	call site: 00125	addportandaddress
23	857	checktimeouts	call site: 00857	send_msg_kexinit
20	74	wrapfd_remove	call site: 00074	write_urandom
16	39	sha256_done	call site: 00039	seedrandom
16	599	fuzz_get_socket_address	call site: 00599	getaddrstring
14	209	svr_getopts	call site: 00209	print_algos
11	483	s_mp_mul_digs_fast	call site: 00483	mp_mul
10	470	ecc_is_point	call site: 00470	s_mp_balance_mul
9	166	buf_new	call site: 00166	buf_readfile
7	150	m_free_direct	call site: 00150	addhostkey

Runtime coverage analysis

Covered functions

358

Functions that are reachable but not covered

103

Reachable functions

306

Percentage of reachable functions covered

66.34%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-postauth_nomaths.c	1
src/../fuzz/fuzz-common.c	10
src/dbutil.c	16
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	22
src/dbhelpers.c	1
src/ecc.c	4
src/svr-runopts.c	5
src/common-runopts.c	4
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/svr-session.c	2
src/common-session.c	12
src/netio.c	11
src/queue.c	5
src/svr-auth.c	1
src/common-channel.c	15
src/listener.c	3
src/svr-chansession.c	2
src/packet.c	11
src/common-kex.c	4
src/common-algo.c	3
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	5
src/list.c	1
src/atomicio.c	1
src/process-packet.c	2

Fuzzer: fuzzer-kexdh

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	217	49.2%
gold	[1:9]	3	0.68%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	3	0.68%
lawngreen	50+	218	49.4%
All colors	441	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
36	196	mp_clear_multi	call site: 00196	mp_exptmod
23	274	s_mp_mul_digs_fast	call site: 00274	mp_mul
16	179	mp_div_2	call site: 00179	mp_sub
14	257	s_mp_sqr_fast	call site: 00257	mp_mul
10	244	mp_2expt	call site: 00244	mp_mod
9	233	mp_exptmod	call site: 00233	s_mp_exptmod
8	374	buf_putmpint	call site: 00374	buf_put_rsa_pub_key
6	103	m_free_direct	call site: 00103	mp_invmod
6	158	mp_div_2d	call site: 00158	mp_mod_2d
6	307	s_mp_exptmod_fast	call site: 00307	mp_reduce_2k_setup
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
5	150	mp_add	call site: 00150	s_mp_sub

Runtime coverage analysis

Covered functions

153

Functions that are reachable but not covered

31

Reachable functions

134

Percentage of reachable functions covered

76.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexdh.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	3
src/dbrandom.c	1
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/buffer.c	19
src/dbutil.c	2
src/bignum.c	4
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
src/kex-dh.c	2
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_clear_multi.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/dbhelpers.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-cliconf

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	600	77.5%
gold	[1:9]	50	6.45%
yellow	[10:29]	1	0.12%
greenyellow	[30:49]	1	0.12%
lawngreen	50+	122	15.7%
All colors	774	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
166	339	buf_getbyte	call site: 00339	ecc_is_point
104	218	m_free_direct	call site: 00218	buf_get_ecdsa_priv_key
45	573	buf_putbyte	call site: 00573	algolist_string
42	122	m_strdup	call site: 00122	add_extendedopt
41	523	loadidentityfile	call site: 00523	loadidentityfile
23	74	wrapfd_close	call site: 00074	write_urandom
23	717	parse_multihop_hostname	call site: 00717	multihop_args
17	676	cli_getopts	call site: 00676	split_address_port
15	38	sha256_done	call site: 00038	seedrandom
14	192	m_close	call site: 00192	buf_get_priv_key
11	62	buf_getptr	call site: 00062	sha256_process
11	694	cli_getopts	call site: 00694	parse_recv_window

Runtime coverage analysis

Covered functions

70

Functions that are reachable but not covered

143

Reachable functions

210

Percentage of reachable functions covered

31.9%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-cliconf.c	2
src/../fuzz/fuzz-common.c	3
src/dbutil.c	11
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	7
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	5
src/buffer.c	21
src/dbhelpers.c	1
src/ecc.c	4
src/cli-runopts.c	13
src/list.c	2
src/common-runopts.c	6
src/signkey.c	5
src/dss.c	3
src/bignum.c	2
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	3
src/ecdsa.c	3
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	1
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	2
src/common-algo.c	5
src/cli-readconf.c	1
src/compat.c	1

Fuzzer: fuzzer-client_nomaths

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1615	77.9%
gold	[1:9]	114	5.50%
yellow	[10:29]	3	0.14%
greenyellow	[30:49]	1	0.04%
lawngreen	50+	338	16.3%
All colors	2071	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
310	1610	buf_has_algo	call site: 01610	send_msg_userauth_pubkey
277	1236	cli_sessionloop	call site: 01236	gen_kexdh_param
153	340	buf_getbyte	call site: 00340	ecc_is_point
99	1924	cbuf_new	call site: 01924	setup_localtcp
75	1525	cli_auth_getmethods	call site: 01525	cli_auth_try
63	1131	session_loop	call site: 01131	check_close
51	257	m_realloc	call site: 00257	buf_get_rsa_priv_key
43	938	session_loop	call site: 00938	connect_try_next
42	123	m_strdup	call site: 00123	add_extendedopt
41	632	parse_hostname	call site: 00632	read_config_file
39	526	list_append	call site: 00526	loadidentityfile
38	581	buf_put_algolist_all	call site: 00581	algolist_string

Runtime coverage analysis

Covered functions

202

Functions that are reachable but not covered

319

Reachable functions

475

Percentage of reachable functions covered

32.84%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-client_nomaths.c	1
src/../fuzz/fuzz-common.c	8
src/dbutil.c	19
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	8
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	26
src/dbhelpers.c	1
src/ecc.c	6
src/cli-runopts.c	13
src/list.c	3
src/common-runopts.c	6
src/signkey.c	12
src/dss.c	5
src/bignum.c	5
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	6
src/ecdsa.c	5
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	5
src/common-algo.c	8
src/cli-readconf.c	1
src/compat.c	2
src/cli-session.c	6
src/common-session.c	13
src/netio.c	13
src/queue.c	5
src/common-channel.c	18
src/listener.c	6
src/packet.c	11
src/common-kex.c	4
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	6
src/atomicio.c	1
src/process-packet.c	2
src/cli-kex.c	2
src/kex-dh.c	3
src/kex-ecdh.c	2
src/kex-x25519.c	2
src/kex-pqhybrid.c	2
libtommath/bn_mp_set_ul.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ecc_make_key.c	1
libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
src/curve25519.c	21
src/cli-auth.c	3
src/cli-authpubkey.c	3
src/cli-agentfwd.c	5
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_addmod.c	1
libtommath/bn_mp_set_u64.c	1
libtomcrypt/src/hashes/sha2/sha512.c	4
src/cli-authinteract.c	1
src/cli-authpasswd.c	1
src/cli-chansession.c	4
src/cli-tcpfwd.c	5
src/tcp-accept.c	3

Fuzzer: fuzzer-kexsntrup-srv

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	148	45.8%
gold	[1:9]	51	15.7%
yellow	[10:29]	2	0.61%
greenyellow	[30:49]	15	4.64%
lawngreen	50+	107	33.1%
All colors	323	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
27	65	buf_getptr	call site: 00065	write_urandom
23	41	genrandom	call site: 00041	seedrandom
22	261	buf_put_pub_key	call site: 00261	buf_put_ecdsa_pub_key
12	209	buf_putstring	call site: 00209	buf_putmpint
11	249	mp_div_2d	call site: 00249	buf_put_rsa_pub_key
7	241	mp_div_2d	call site: 00241	mp_mod_2d
5	2	fuzz_set_input	call site: 00002	wrapfd_remove
4	184	kexpqhybrid_comb_key	call site: 00184	buf_putbytes
4	203	buf_put_pub_key	call site: 00203	buf_put_dss_pub_key
3	93	genrandom	call site: 00093	explicit_bzero
2	12	sha256_init	call site: 00012	fprintf
2	15	fuzz_seed	call site: 00015	sha256_compress

Runtime coverage analysis

Covered functions

192

Functions that are reachable but not covered

44

Reachable functions

119

Percentage of reachable functions covered

63.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-kexsntrup-srv.c	1
src/../fuzz/fuzz-common.c	1
src/../fuzz/fuzz-wrapfd.c	5
src/dbrandom.c	6
libtomcrypt/src/hashes/sha2/sha256.c	4
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
src/dbmalloc.c	11
src/kex-pqhybrid.c	3
src/dbutil.c	4
src/kex-x25519.c	3
src/buffer.c	21
src/dbhelpers.c	1
src/curve25519.c	10
src/signkey.c	2
src/dss.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_rshd.c	1
src/rsa.c	1
src/ecdsa.c	2
src/ecc.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
libtomcrypt/src/misc/zeromem.c	1
src/ed25519.c	1
src/common-kex.c	1

Fuzzer: fuzzer-client

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1090	52.6%
gold	[1:9]	116	5.60%
yellow	[10:29]	19	0.91%
greenyellow	[30:49]	13	0.62%
lawngreen	50+	833	40.2%
All colors	2071	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
157	1866	par25519	call site: 01866	setup_localtcp
82	1131	session_loop	call site: 01131	check_close
60	1752	rsa_pad_em	call site: 01752	mp_exptmod
43	938	session_loop	call site: 00938	connect_try_next
43	1525	cli_auth_getmethods	call site: 01525	cli_auth_try
42	123	m_strdup	call site: 00123	add_extendedopt
41	632	parse_hostname	call site: 00632	read_config_file
39	526	list_append	call site: 00526	loadidentityfile
39	1699	sha1_done	call site: 01699	buf_put_rsa_sign
38	581	buf_put_algolist_all	call site: 00581	algolist_string
26	1006	checktimeouts	call site: 01006	send_msg_kexinit
26	1663	buf_put_pub_key	call site: 01663	cli_buf_put_sign

Runtime coverage analysis

Covered functions

639

Functions that are reachable but not covered

189

Reachable functions

475

Percentage of reachable functions covered

60.21%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
src/../fuzz/fuzzer-client.c	1
src/../fuzz/fuzz-common.c	8
src/dbutil.c	19
src/dbmalloc.c	12
src/crypto_desc.c	2
libtomcrypt/src/misc/crypt/crypt_register_cipher.c	1
libtomcrypt/src/misc/crypt/crypt_argchk.c	1
libtomcrypt/src/misc/crypt/crypt_register_hash.c	1
libtomcrypt/src/misc/crypt/crypt_register_prng.c	1
libtommath/bn_mp_rand.c	1
src/dbrandom.c	8
libtomcrypt/src/hashes/sha2/sha256.c	4
src/../fuzz/fuzz-wrapfd.c	7
src/buffer.c	26
src/dbhelpers.c	1
src/ecc.c	6
src/cli-runopts.c	13
src/list.c	3
src/common-runopts.c	6
src/signkey.c	12
src/dss.c	5
src/bignum.c	5
libtommath/bn_mp_clear.c	1
libtommath/bn_mp_init.c	1
libtommath/bn_mp_zero.c	1
libtommath/bn_mp_from_ubin.c	1
libtommath/bn_mp_grow.c	1
libtommath/bn_mp_mul_2d.c	1
libtommath/bn_mp_copy.c	1
libtommath/bn_mp_lshd.c	1
libtommath/bn_mp_clamp.c	1
libtommath/bn_mp_count_bits.c	1
libtommath/bn_mp_cmp_d.c	1
libtommath/bn_mp_cmp.c	1
libtommath/bn_mp_cmp_mag.c	1
src/rsa.c	6
src/ecdsa.c	5
libtomcrypt/src/pk/ecc/ecc_free.c	1
libtomcrypt/src/math/multi.c	2
libtommath/bn_mp_set.c	1
libtommath/bn_mp_read_radix.c	1
libtommath/bn_mp_mul_d.c	1
libtommath/bn_mp_add_d.c	1
libtommath/bn_mp_sub_d.c	1
libtommath/bn_mp_sqr.c	1
libtommath/bn_s_mp_sqr_fast.c	1
libtommath/bn_s_mp_sqr.c	1
libtommath/bn_mp_init_size.c	1
libtommath/bn_mp_exch.c	1
libtommath/bn_mp_mod.c	1
libtommath/bn_mp_div.c	1
libtommath/bn_mp_init_copy.c	1
libtommath/bn_mp_sub.c	1
libtommath/bn_s_mp_add.c	1
libtommath/bn_s_mp_sub.c	1
libtommath/bn_mp_rshd.c	1
libtommath/bn_mp_add.c	1
libtommath/bn_mp_div_2d.c	1
libtommath/bn_mp_mod_2d.c	1
libtommath/bn_mp_mul.c	1
libtommath/bn_s_mp_balance_mul.c	1
libtommath/bn_mp_init_multi.c	1
libtommath/bn_s_mp_mul_digs_fast.c	1
libtommath/bn_s_mp_mul_digs.c	1
libtommath/bn_mp_clear_multi.c	1
src/ed25519.c	5
src/common-algo.c	8
src/cli-readconf.c	1
src/compat.c	2
src/cli-session.c	6
src/common-session.c	13
src/netio.c	13
src/queue.c	5
src/common-channel.c	18
src/listener.c	6
src/packet.c	11
src/common-kex.c	4
libtomcrypt/src/mac/hmac/hmac_init.c	1
libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	1
libtomcrypt/src/hashes/helper/hash_memory.c	1
libtomcrypt/src/misc/zeromem.c	1
libtomcrypt/src/mac/hmac/hmac_process.c	1
libtomcrypt/src/mac/hmac/hmac_done.c	1
src/circbuffer.c	6
src/atomicio.c	1
src/process-packet.c	2
src/cli-kex.c	2
src/kex-dh.c	3
src/kex-ecdh.c	2
src/kex-x25519.c	2
src/kex-pqhybrid.c	2
libtommath/bn_mp_set_ul.c	1
libtommath/bn_mp_div_2.c	1
libtommath/bn_mp_exptmod.c	1
libtommath/bn_mp_invmod.c	1
libtommath/bn_s_mp_invmod_fast.c	1
libtommath/bn_s_mp_invmod_slow.c	1
libtommath/bn_mp_abs.c	1
libtommath/bn_mp_reduce_is_2k_l.c	1
libtommath/bn_s_mp_exptmod.c	1
libtommath/bn_mp_reduce_setup.c	1
libtommath/bn_mp_2expt.c	1
libtommath/bn_mp_reduce_2k_setup_l.c	1
libtommath/bn_mp_dr_is_modulus.c	1
libtommath/bn_mp_reduce_is_2k.c	1
libtommath/bn_s_mp_exptmod_fast.c	1
libtommath/bn_mp_montgomery_setup.c	1
libtommath/bn_mp_dr_setup.c	1
libtommath/bn_mp_reduce_2k_setup.c	1
libtommath/bn_mp_montgomery_calc_normalization.c	1
libtommath/bn_mp_mul_2.c	1
libtommath/bn_mp_mulmod.c	1
libtommath/bn_mp_to_ubin.c	1
libtommath/bn_mp_ubin_size.c	1
libtomcrypt/src/pk/ecc/ecc_make_key.c	1
libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_points.c	2
libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	1
libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	1
src/curve25519.c	21
src/cli-auth.c	3
src/cli-authpubkey.c	3
src/cli-agentfwd.c	5
libtomcrypt/src/hashes/sha1.c	4
libtomcrypt/src/headers/tomcrypt_macros.h	1
libtommath/bn_mp_addmod.c	1
libtommath/bn_mp_set_u64.c	1
libtomcrypt/src/hashes/sha2/sha512.c	4
src/cli-authinteract.c	1
src/cli-authpasswd.c	1
src/cli-chansession.c	4
src/cli-tcpfwd.c	5
src/tcp-accept.c	3

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
crypto_kem_mlkem768_dec	/src/dropbear/src/mlkem768.c	3	['N/A', 'N/A', 'N/A']	16	0	31	3	2	311	0	743	737
chansessionrequest	/src/dropbear/src/svr-chansession.c	1	['N/A']	11	0	179	39	12	214	0	843	356
send_msg_kexdh_reply	/src/dropbear/src/svr-kex.c	2	['N/A', 'N/A']	14	0	148	18	4	322	1	2029	168
ltc_ecc_projective_add_point	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c	5	['N/A', 'N/A', 'N/A', 'N/A', 'N/A']	3	0	1362	209	86	6	0	163	146
crypto_kem_sntrup761_dec	/src/dropbear/src/sntrup761.c	3	['N/A', 'N/A', 'N/A']	7	0	93	7	3	39	0	147	114
svr_auth_pubkey	/src/dropbear/src/svr-authpubkey.c	1	['int']	13	0	401	57	19	274	1	1749	91
crypto_kem_sntrup761_keypair	/src/dropbear/src/sntrup761.c	2	['N/A', 'N/A']	11	0	54	7	3	62	0	275	83
crypto_kem_mlkem768_keypair	/src/dropbear/src/mlkem768.c	2	['N/A', 'N/A']	16	0	36	3	2	273	0	702	65
ltc_ecc_mul2add	/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mul2add.c	6	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A']	4	0	864	132	42	17	0	103	56
dropbear_chachapoly_crypt	/src/dropbear/src/chachapoly.c	7	['int', 'N/A', 'N/A', 'size_t', 'size_t', 'N/A', 'int']	4	0	173	25	10	13	0	62	52

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

970 / 1210

Cyclomatic complexity statically reachable by fuzzers

4973 / 6202

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

src/../fuzz/fuzzer-pubkey.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

src/../fuzz/fuzzer-kexcurve25519.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_put_pub_key', 'buf_putmpint', 'mp_div_2d', 'fuzz_set_input', 'sha256_init', 'fuzz_seed', 'mp_from_ubin', 'sha256_done', 'buf_getint']

src/../fuzz/fuzzer-kexecdh.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['s_mp_mul_digs_fast', 'buf_putmpint', 'mp_div_2d', 'mp_init_multi', 'fuzz_set_input', 'buf_put_ecc_raw_pubkey_string', 'mp_read_radix', 'buf_put_pub_key', 'mp_init_size', 'ecc_is_point']

src/../fuzz/fuzzer-kexsntrup-cli.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['fail_assert', 'buf_getptr', 'buf_put_pub_key', 'genrandom', 'kexpqhybrid_comb_key', 'LLVMFuzzerTestOneInput', 'fuzz_set_input', 'buf_put_rsa_pub_key']

src/../fuzz/fuzzer-verify.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'sha256_done', 'dropbear_ed25519_verify', 's_mp_mul_digs', 'mp_init_multi', 'buf_dss_verify', 's_mp_exptmod_fast', 'mp_prime_is_prime', 'mp_read_radix', 'register_cipher']

src/../fuzz/fuzzer-preauth_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_close', 'm_strdup', 'checktimeouts', 'wrapfd_remove', 'sha256_done', 'fuzz_get_socket_address', 'svr_getopts', 's_mp_mul_digs_fast']

src/../fuzz/fuzzer-kexmlkem-srv.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'genrandom', 'buf_put_pub_key', 'buf_putstring', 'mp_div_2d', 'fuzz_set_input', 'kexpqhybrid_comb_key']

src/../fuzz/fuzzer-kexmlkem-cli.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['fail_assert', 'buf_getptr', 'buf_put_pub_key', 'genrandom', 'kexpqhybrid_comb_key', 'LLVMFuzzerTestOneInput', 'fuzz_set_input', 'buf_put_rsa_pub_key']

src/../fuzz/fuzzer-preauth.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_close', 'm_strdup', 'checktimeouts', 'wrapfd_remove', 'sha256_done', 'fuzz_get_socket_address', 'svr_getopts', 's_mp_mul_digs_fast']

src/../fuzz/fuzzer-postauth_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['session_loop', 'm_close', 'm_strdup', 'checktimeouts', 'wrapfd_remove', 'sha256_done', 'fuzz_get_socket_address', 'svr_getopts', 's_mp_mul_digs_fast', 'ecc_is_point']

src/../fuzz/fuzzer-kexdh.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['mp_clear_multi', 's_mp_mul_digs_fast', 'mp_div_2', 's_mp_sqr_fast', 'mp_2expt', 'mp_exptmod', 'buf_putmpint', 'm_free_direct', 'mp_div_2d', 's_mp_exptmod_fast']

src/../fuzz/fuzzer-cliconf.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getbyte', 'm_free_direct', 'buf_putbyte', 'm_strdup', 'loadidentityfile', 'wrapfd_close', 'parse_multihop_hostname', 'cli_getopts', 'sha256_done', 'm_close']

src/../fuzz/fuzzer-client_nomaths.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_has_algo', 'cli_sessionloop', 'buf_getbyte', 'cbuf_new', 'cli_auth_getmethods', 'session_loop', 'm_realloc', 'm_strdup', 'parse_hostname']

src/../fuzz/fuzzer-kexsntrup-srv.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['buf_getptr', 'genrandom', 'buf_put_pub_key', 'buf_putstring', 'mp_div_2d', 'fuzz_set_input', 'kexpqhybrid_comb_key']

src/../fuzz/fuzzer-client.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['par25519', 'session_loop', 'rsa_pad_em', 'cli_auth_getmethods', 'm_strdup', 'parse_hostname', 'list_append', 'sha1_done', 'buf_put_algolist_all']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
signkey_key_ptr	37	16	43.24%	['fuzzer-client_nomaths', 'fuzzer-kexmlkem-cli', 'fuzzer-verify', 'fuzzer-kexecdh', 'fuzzer-preauth_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-kexmlkem-srv', 'fuzzer-kexcurve25519', 'fuzzer-postauth_nomaths', 'fuzzer-kexsntrup-cli']
svr_getopts	281	88	31.31%	['fuzzer-preauth_nomaths', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-srv', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-kexmlkem-srv', 'fuzzer-kexcurve25519', 'fuzzer-postauth_nomaths']
mp_montgomery_reduce	45	10	22.22%	['fuzzer-verify', 'fuzzer-kexecdh', 'fuzzer-client', 'fuzzer-preauth']
cli_getopts	360	163	45.27%	['fuzzer-client_nomaths', 'fuzzer-kexmlkem-cli', 'fuzzer-client', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli']
parse_multihop_hostname	33	16	48.48%	['fuzzer-client_nomaths', 'fuzzer-kexmlkem-cli', 'fuzzer-client', 'fuzzer-cliconf', 'fuzzer-kexsntrup-cli']
mp_exptmod	41	18	43.90%	['fuzzer-client_nomaths', 'fuzzer-verify', 'fuzzer-client', 'fuzzer-preauth', 'fuzzer-kexdh']
mp_prime_is_prime	128	59	46.09%	['fuzzer-verify']
mp_reduce	52	26	50.0%	['fuzzer-verify', 'fuzzer-client']
mp_sqrt	44	23	52.27%	['fuzzer-verify']
s_mp_mul_digs	41	12	29.26%	['fuzzer-client_nomaths', 'fuzzer-verify', 'fuzzer-kexecdh', 'fuzzer-preauth_nomaths', 'fuzzer-client', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-postauth_nomaths']
s_mp_mul_high_digs	40	13	32.5%	['fuzzer-verify', 'fuzzer-client']
buf_ecdsa_verify	98	53	54.08%	['fuzzer-verify', 'fuzzer-client']
ctr_encrypt	38	14	36.84%	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
ctr_start	44	22	50.0%	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
checktimeouts	40	16	40.0%	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-client', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
set_sock_priority	40	8	20.0%	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-client', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
write_packet	33	18	54.54%	['fuzzer-client_nomaths', 'fuzzer-preauth_nomaths', 'fuzzer-client', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
svr_auth_password	64	30	46.87%	['fuzzer-preauth_nomaths', 'fuzzer-preauth']
svr_auth_pubkey	119	55	46.21%	['fuzzer-preauth_nomaths', 'fuzzer-preauth']
svr_chansess_checksignal	35	6	17.14%	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
libcrux_sha3_generic_keccak_keccak_e9	61	20	32.78%	['fuzzer-kexmlkem-srv', 'fuzzer-client', 'fuzzer-kexmlkem-cli']
libcrux_sha3_generic_keccak_keccak_e91	61	29	47.54%	['fuzzer-kexmlkem-srv', 'fuzzer-client', 'fuzzer-kexmlkem-cli']
libcrux_sha3_generic_keccak_keccak_e90	61	29	47.54%	['fuzzer-kexmlkem-srv', 'fuzzer-client', 'fuzzer-kexmlkem-cli']
spawn_command	68	11	16.17%	['fuzzer-postauth_nomaths']
connect_remote	40	18	45.0%	['fuzzer-postauth_nomaths']
connect_streamlocal	34	16	47.05%	['fuzzer-postauth_nomaths']
dropbear_listen	117	13	11.11%	['fuzzer-client_nomaths', 'fuzzer-client', 'fuzzer-postauth_nomaths']
pty_setowner	45	14	31.11%	['fuzzer-postauth_nomaths']
svr_agentreq	39	17	43.58%	['fuzzer-postauth_nomaths']
ptycommand	80	14	17.5%	['fuzzer-postauth_nomaths']
get_termmodes	66	14	21.21%	['fuzzer-postauth_nomaths']
listen_streamlocal	62	16	25.80%	['fuzzer-postauth_nomaths']
cli_sessionloop	91	33	36.26%	['fuzzer-client_nomaths', 'fuzzer-client']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/dropbear/src/svr-service.c	[]	[]
/src/dropbear/src/ed25519.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_grow.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-pubkey.c	['fuzzer-pubkey']	[]
/src/dropbear/src/svr-authpasswd.c	[]	[]
/src/dropbear/libtommath/bn_mp_zero.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_ubin_size.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/gensignkey.c	[]	[]
/src/dropbear/libtommath/bn_mp_init.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_prime_rabin_miller_trials.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mulmod_timing.c	[]	[]
/src/dropbear/libtomcrypt/src/ciphers/aes/aes.c	[]	[]
/src/dropbear/libtommath/bn_mp_mul.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_add.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_sqr.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify']
/src/dropbear/src/svr-forward.c	[]	[]
/src/dropbear/src/svr-runopts.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_reduce_setup.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/cli-readconf.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-cliconf']
/src/dropbear/libtommath/bn_mp_cmp_d.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_dr_reduce.c	[]	[]
/src/dropbear/src/netio.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_mul2add.c	[]	[]
/src/dropbear/libtommath/bn_mp_clamp.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/base64/base64_decode.c	['fuzzer-pubkey']	[]
/src/dropbear/src/../fuzz/fuzzer-preauth_nomaths.c	['fuzzer-preauth_nomaths']	[]
/src/dropbear/src/cli-kex.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_invmod_fast.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/svr-agentfwd.c	[]	[]
/src/dropbear/libtommath/bn_mp_sqrmod.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/loginrec.c	[]	[]
/src/dropbear/libtommath/bn_mp_mul_2d.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/dbhelpers.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/base64/base64_encode.c	['fuzzer-pubkey']	[]
/src/dropbear/src/kex-ecdh.c	['fuzzer-kexecdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_clear_multi.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cmp.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_div_d.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/chachapoly.c	[]	[]
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_setup.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_dbl_point.c	[]	[]
/src/dropbear/libtommath/bn_mp_prime_next_prime.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_ansi_x963_export.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_montgomery_reduce_fast.c	[]	[]
/src/dropbear/libtommath/bn_mp_is_square.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/sntrup761.c	[]	[]
/src/dropbear/libtommath/bn_mp_neg.c	[]	[]
/src/dropbear/src/signkey.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/dbmalloc.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/mac/poly1305/poly1305.c	[]	[]
/src/dropbear/src/kex-dh.c	['fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/cli-channel.c	[]	[]
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_ivctr64.c	[]	[]
/src/dropbear/src/kex-pqhybrid.c	['fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/ecdsa.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_prng_is_valid.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_copy.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_rshd.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/crypto_desc.c	['fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/dss.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_cnt_lsb.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/curve25519.c	['fuzzer-kexcurve25519', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_prng.c	['fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_add_d.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/sha1.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_u32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-client.c	['fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_rand.c	['fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_map.c	[]	[]
/src/dropbear/libtommath/bn_mp_montgomery_reduce.c	[]	[]
/src/dropbear/libtomcrypt/src/hashes/sha2/sha512.c	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/zeromem.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_get_mag_ul.c	[]	[]
/src/dropbear/src/svr-authpubkey.c	['fuzzer-pubkey']	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_points.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mod_d.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_init.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_set_u32.c	['fuzzer-verify']	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_cipher_is_valid.c	[]	[]
/src/dropbear/src/sntrup761_compat.h	[]	[]
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	[]	[]
/src/dropbear/src/cli-tcpfwd.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_start.c	[]	[]
/src/dropbear/libtommath/bn_mp_clear.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-kexsntrup-cli.c	['fuzzer-kexsntrup-cli']	[]
/src/dropbear/libtommath/bn_mp_reduce_is_2k_l.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/ecc.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_sqrt.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/common-channel.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_get_mag_u32.c	['fuzzer-verify']	[]
/src/dropbear/src/cli-chansession.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k_l.c	[]	[]
/src/dropbear/src/../fuzz/fuzzer-kexmlkem-cli.c	['fuzzer-kexmlkem-cli']	[]
/src/dropbear/src/gendss.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_cipher.c	['fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/libcrux_mlkem768_sha3.h	[]	[]
/src/dropbear/libtommath/bn_mp_read_radix.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_process.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_get_i32.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_exptmod.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-kexcurve25519.c	['fuzzer-kexcurve25519']	[]
/src/dropbear/src/../fuzz/fuzzer-kexmlkem-srv.c	['fuzzer-kexmlkem-srv']	[]
/src/dropbear/libtomcrypt/src/math/multi.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_to_ubin.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_init_set.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/../fuzz/fuzz-common.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	[]
/src/dropbear/src/cli-agentfwd.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/src/../fuzz/fuzzer-kexdh.c	['fuzzer-kexdh']	[]
/src/dropbear/src/bignum.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_mul_high_digs_fast.c	[]	[]
/src/dropbear/src/listener.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/math/ltm_desc.c	[]	[]
/src/dropbear/libtommath/bn_mp_addmod.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_div_2d.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/sha2/sha256.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_encrypt.c	[]	[]
/src/dropbear/libtommath/bn_mp_prime_is_prime.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/src/../fuzz/fuzzer-postauth_nomaths.c	['fuzzer-postauth_nomaths']	[]
/src/dropbear/libtommath/bn_s_mp_mul_high_digs.c	[]	[]
/src/dropbear/src/cli-authpasswd.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/common-session.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_hash_is_valid.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_montgomery_calc_normalization.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/kex-x25519.c	['fuzzer-kexcurve25519', 'fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/svr-session.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/src/svr-authpubkeyoptions.c	['fuzzer-pubkey']	[]
/src/dropbear/libtommath/bn_mp_init_multi.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth', 'fuzzer-client']
/src/dropbear/src/dbutil.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_is_2k.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-preauth.c	['fuzzer-preauth']	[]
/src/dropbear/src/svr-kex.c	[]	[]
/src/dropbear/src/svr-chansession.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_s_mp_sub.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k_setup.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_mod_2d.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/packet.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_is_valid_idx.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_gcd.c	[]	[]
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_find_cipher.c	[]	[]
/src/dropbear/src/buffer.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_dr_is_modulus.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_set_u64.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_div.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/svr-auth.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_register_hash.c	['fuzzer-pubkey', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k.c	[]	[]
/src/dropbear/src/list.c	['fuzzer-pubkey', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/circbuffer.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-postauth_nomaths', 'fuzzer-client_nomaths']
/src/dropbear/libtommath/bn_mp_invmod.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_montgomery_setup.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/tcp-accept.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/cli-authpubkey.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths']
/src/dropbear/src/svr-tcpfwd.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_make_key.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client']
/src/dropbear/libtommath/bn_mp_mod.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce.c	[]	[]
/src/dropbear/libtommath/bn_mp_dr_setup.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/genrsa.c	[]	[]
/src/dropbear/libtommath/bn_mp_cmp_mag.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_exch.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/cli-session.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_s_mp_balance_mul.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_mp_add.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzz-wrapfd.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	[]
/src/dropbear/src/svr-streamfwd.c	[]	[]
/src/dropbear/libtommath/bn_mp_from_ubin.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/cli-runopts.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/cli-authinteract.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_crypt.c	[]	[]
/src/dropbear/libtomcrypt/src/hashes/helper/hash_memory.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ltc_ecc_projective_add_point.c	[]	[]
/src/dropbear/libtommath/bn_mp_set_ul.c	['fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/src/common-kex.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/sshpty.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_exptmod_fast.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/rsa.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/sk-ecdsa.c	['fuzzer-verify']	[]
/src/dropbear/libtommath/bn_s_mp_reverse.c	[]	[]
/src/dropbear/libtommath/bn_mp_sub.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_find_hash.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_invmod_slow.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-client_nomaths.c	['fuzzer-client_nomaths']	[]
/src/dropbear/src/cli-auth.c	['fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_2expt.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/sk-ed25519.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_s_mp_sqr_fast.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/dbrandom.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-kexsntrup-srv.c	['fuzzer-kexsntrup-srv']	[]
/src/dropbear/libtommath/bn_mp_to_radix.c	[]	[]
/src/dropbear/src/../fuzz/fuzzer-kexecdh.c	['fuzzer-kexecdh']	[]
/src/dropbear/libtomcrypt/src/modes/ctr/ctr_decrypt.c	[]	[]
/src/dropbear/libtommath/bn_mp_count_bits.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/hashes/sha2/sha384.c	[]	[]
/src/dropbear/libtommath/bn_mp_init_size.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/queue.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mul_d.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_prime_miller_rabin.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_submod.c	[]	[]
/src/dropbear/src/common-runopts.c	['fuzzer-pubkey', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/src/ltc_prng.c	[]	[]
/src/dropbear/libtomcrypt/src/pk/ecc/ecc_free.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/gened25519.c	[]	[]
/src/dropbear/libtomcrypt/src/mac/hmac/hmac_done.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths']
/src/dropbear/libtommath/bn_mp_abs.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_s_mp_prime_is_divisible.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtommath/bn_mp_get_l.c	[]	[]
/src/dropbear/libtommath/bn_mp_div_2.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/compat.c	['fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_div_3.c	['fuzzer-verify']	['fuzzer-verify']
/src/dropbear/libtomcrypt/src/stream/chacha/chacha_keystream.c	[]	[]
/src/dropbear/src/../fuzz/fuzzer-cliconf.c	['fuzzer-cliconf']	[]
/src/dropbear/libtommath/bn_mp_copy.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-kexsntrup-srv', 'fuzzer-client']
/src/dropbear/src/mlkem768.c	[]	[]
/src/dropbear/libtommath/bn_mp_mulmod.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_mul_2.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_set.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzz-sshpacketmutator.c	[]	[]
/src/dropbear/libtommath/bn_mp_sub_d.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-preauth', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/src/common-algo.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_reduce_2k_setup_l.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/../fuzz/fuzzer-verify.c	['fuzzer-verify']	[]
/src/dropbear/libtommath/bn_mp_sqr.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/misc/crypt/crypt_argchk.c	['fuzzer-pubkey', 'fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-kexsntrup-cli', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-kexmlkem-srv', 'fuzzer-kexmlkem-cli', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-kexsntrup-srv', 'fuzzer-client']	[]
/src/dropbear/src/atomicio.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	[]
/src/dropbear/libtommath/bn_s_mp_mul_digs_fast.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_lcm.c	[]	[]
/src/dropbear/libtommath/bn_s_mp_mul_digs.c	['fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/src/process-packet.c	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-client_nomaths', 'fuzzer-client']
/src/dropbear/libtomcrypt/src/headers/tomcrypt_macros.h	['fuzzer-verify', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_lshd.c	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-cliconf', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-kexcurve25519', 'fuzzer-kexecdh', 'fuzzer-verify', 'fuzzer-preauth_nomaths', 'fuzzer-preauth', 'fuzzer-postauth_nomaths', 'fuzzer-kexdh', 'fuzzer-client']
/src/dropbear/libtommath/bn_mp_exptmod.c	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client_nomaths', 'fuzzer-client']	['fuzzer-verify', 'fuzzer-kexdh', 'fuzzer-client']

Directories in report

Directory
/src/dropbear/libtomcrypt/src/misc/crypt/
/src/dropbear/libtomcrypt/src/math/
/src/dropbear/libtomcrypt/src/misc/base64/
/src/dropbear/libtomcrypt/src/ciphers/aes/
/src/dropbear/src/../fuzz/
/src/dropbear/libtomcrypt/src/headers/
/usr/include/x86_64-linux-gnu/bits/
/src/dropbear/libtomcrypt/src/mac/poly1305/
/src/dropbear/libtomcrypt/src/pk/ecc/
/src/dropbear/libtommath/
/src/dropbear/libtomcrypt/src/hashes/
/src/dropbear/libtomcrypt/src/misc/
/src/dropbear/libtomcrypt/src/hashes/sha2/
/src/dropbear/src/
/src/dropbear/libtomcrypt/src/stream/chacha/
/src/dropbear/libtomcrypt/src/mac/hmac/
/src/dropbear/libtomcrypt/src/hashes/helper/
/src/dropbear/libtomcrypt/src/modes/ctr/