LLVMFuzzerTestOneInput:
   35|     77|extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   36|     77|    if (size < 2) return 0;
  ------------------
  |  Branch (36:9): [True: 1, False: 76]
  ------------------
   37|       |
   38|     76|    const uint8_t* payload = data;
   39|     76|    size_t payload_len = size;
   40|       |
   41|     76|    if (!validate_nsm_msg_length(payload, payload_len)) {
  ------------------
  |  Branch (41:9): [True: 3, False: 73]
  ------------------
   42|      3|        return 0;
   43|      3|    }
   44|       |
   45|     73|    const struct nsm_msg* msg = reinterpret_cast<const struct nsm_msg*>(payload);
   46|     73|    const struct nsm_msg_hdr* hdr = reinterpret_cast<const struct nsm_msg_hdr*>(payload);
   47|       |
   48|       |    // Mismatch prevention: verify request/response type
   49|     73|    if (hdr->request != false) {
  ------------------
  |  Branch (49:9): [True: 10, False: 63]
  ------------------
   50|     10|        return 0;
   51|     10|    }
   52|       |
   53|     63|    std::vector<uint8_t> out_buf(65536, 0);
   54|     63|    std::vector<uint8_t> fuzz_instance_id_buf(65536, 0);
   55|     63|    uint8_t* fuzz_instance_id = reinterpret_cast<uint8_t*>(fuzz_instance_id_buf.data());
   56|     63|    uint8_t fuzz_cc = 0;
   57|     63|    uint16_t fuzz_reason_code = 0;
   58|     63|    decode_long_running_event(msg, payload_len, fuzz_instance_id, &fuzz_cc, &fuzz_reason_code);
   59|       |
   60|     63|    return 0;
   61|     73|}

_Z23validate_nsm_msg_lengthPKhm:
   27|     76|inline bool validate_nsm_msg_length(const uint8_t* payload, size_t payload_len) {
   28|     76|    return payload_len >= sizeof(struct nsm_msg_hdr);
   29|     76|}

decode_long_running_event:
 1018|     63|{
 1019|     63|	if (msg == NULL) {
  ------------------
  |  Branch (1019:6): [True: 0, False: 63]
  ------------------
 1020|      0|		return NSM_SW_ERROR_NULL;
 1021|      0|	}
 1022|       |
 1023|     63|	if (msg_len < sizeof(struct nsm_msg_hdr) + NSM_EVENT_MIN_LEN +
  ------------------
  |  |   49|     63|#define NSM_EVENT_MIN_LEN 6
  ------------------
  |  Branch (1023:6): [True: 7, False: 56]
  ------------------
 1024|     63|			  sizeof(struct nsm_long_running_resp)) {
 1025|      7|		return NSM_SW_ERROR_LENGTH;
 1026|      7|	}
 1027|       |
 1028|     56|	struct nsm_event *event = (struct nsm_event *)msg->payload;
 1029|     56|	event->event_state = le16toh(event->event_state);
 1030|       |
 1031|     56|	if (instance_id != NULL) {
  ------------------
  |  Branch (1031:6): [True: 56, False: 0]
  ------------------
 1032|     56|		*instance_id =
 1033|     56|		    ((struct nsm_long_running_resp *)event->data)->instance_id;
 1034|     56|	}
 1035|     56|	if (cc != NULL && reason_code != NULL) {
  ------------------
  |  Branch (1035:6): [True: 56, False: 0]
  |  Branch (1035:20): [True: 56, False: 0]
  ------------------
 1036|     56|		*cc = ((struct nsm_long_running_resp *)event->data)
 1037|     56|			  ->completion_code;
 1038|     56|		if (*cc != NSM_SUCCESS) {
  ------------------
  |  Branch (1038:7): [True: 49, False: 7]
  ------------------
 1039|     49|			if (msg_len !=
  ------------------
  |  Branch (1039:8): [True: 41, False: 8]
  ------------------
 1040|     49|			    (sizeof(struct nsm_msg_hdr) + NSM_EVENT_MIN_LEN +
  ------------------
  |  |   49|     49|#define NSM_EVENT_MIN_LEN 6
  ------------------
 1041|     49|			     sizeof(
 1042|     49|				 struct nsm_long_running_non_success_resp))) {
 1043|     41|				return NSM_SW_ERROR_LENGTH;
 1044|     41|			}
 1045|       |
 1046|      8|			struct nsm_long_running_non_success_resp *response =
 1047|      8|			    (struct nsm_long_running_non_success_resp *)
 1048|      8|				event->data;
 1049|       |
 1050|       |			// reason code is expected to be present if CC !=
 1051|       |			// NSM_SUCCESS
 1052|      8|			*reason_code = le16toh(response->reason_code);
 1053|      8|		}
 1054|     56|	}
 1055|     15|	return NSM_SW_SUCCESS;
 1056|     56|}