LLVMFuzzerTestOneInput:
   35|     74|extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   36|     74|    if (size < 2) return 0;
  ------------------
  |  Branch (36:9): [True: 1, False: 73]
  ------------------
   37|       |
   38|     73|    const uint8_t* payload = data;
   39|     73|    size_t payload_len = size;
   40|       |
   41|     73|    if (!validate_nsm_msg_length(payload, payload_len)) {
  ------------------
  |  Branch (41:9): [True: 3, False: 70]
  ------------------
   42|      3|        return 0;
   43|      3|    }
   44|       |
   45|     70|    const struct nsm_msg* msg = reinterpret_cast<const struct nsm_msg*>(payload);
   46|     70|    const struct nsm_msg_hdr* hdr = reinterpret_cast<const struct nsm_msg_hdr*>(payload);
   47|       |
   48|       |    // Mismatch prevention: verify request/response type
   49|     70|    if (hdr->request != true) {
  ------------------
  |  Branch (49:9): [True: 13, False: 57]
  ------------------
   50|     13|        return 0;
   51|     13|    }
   52|       |
   53|     57|    std::vector<uint8_t> out_buf(65536, 0);
   54|     57|    std::vector<uint8_t> fuzz_histogram_id_buf(65536, 0);
   55|     57|    uint32_t* fuzz_histogram_id = reinterpret_cast<uint32_t*>(fuzz_histogram_id_buf.data());
   56|     57|    std::vector<uint8_t> fuzz_parameter_buf(65536, 0);
   57|     57|    uint16_t* fuzz_parameter = reinterpret_cast<uint16_t*>(fuzz_parameter_buf.data());
   58|     57|    decode_get_histogram_data_req(msg, payload_len, fuzz_histogram_id, fuzz_parameter);
   59|       |
   60|     57|    return 0;
   61|     70|}

_Z23validate_nsm_msg_lengthPKhm:
   27|     73|inline bool validate_nsm_msg_length(const uint8_t* payload, size_t payload_len) {
   28|     73|    return payload_len >= sizeof(struct nsm_msg_hdr);
   29|     73|}

decode_get_histogram_data_req:
 1336|     57|{
 1337|     57|	if (msg == NULL || histogram_id == NULL || parameter == NULL) {
  ------------------
  |  Branch (1337:6): [True: 0, False: 57]
  |  Branch (1337:21): [True: 0, False: 57]
  |  Branch (1337:45): [True: 0, False: 57]
  ------------------
 1338|      0|		return NSM_SW_ERROR_NULL;
 1339|      0|	}
 1340|       |
 1341|     57|	if (msg_len <
  ------------------
  |  Branch (1341:6): [True: 6, False: 51]
  ------------------
 1342|     57|	    sizeof(struct nsm_msg_hdr) + sizeof(nsm_get_histogram_data_req)) {
 1343|      6|		return NSM_SW_ERROR_LENGTH;
 1344|      6|	}
 1345|       |
 1346|     51|	nsm_get_histogram_data_req *request =
 1347|     51|	    (nsm_get_histogram_data_req *)msg->payload;
 1348|       |
 1349|     51|	if (request->hdr.data_size <
  ------------------
  |  Branch (1349:6): [True: 32, False: 19]
  ------------------
 1350|     51|	    sizeof(request->histogram_id) + sizeof(request->parameter)) {
 1351|     32|		return NSM_SW_ERROR_DATA;
 1352|     32|	}
 1353|       |
 1354|     19|	*histogram_id = le32toh(request->histogram_id);
 1355|     19|	*parameter = le16toh(request->parameter);
 1356|       |
 1357|     19|	return NSM_SW_SUCCESS;
 1358|     51|}