LLVMFuzzerTestOneInput:
   35|    106|extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   36|    106|    if (size < 2) return 0;
  ------------------
  |  Branch (36:9): [True: 1, False: 105]
  ------------------
   37|       |
   38|    105|    const uint8_t* payload = data;
   39|    105|    size_t payload_len = size;
   40|       |
   41|    105|    if (!validate_nsm_msg_length(payload, payload_len)) {
  ------------------
  |  Branch (41:9): [True: 3, False: 102]
  ------------------
   42|      3|        return 0;
   43|      3|    }
   44|       |
   45|    102|    const struct nsm_msg* msg = reinterpret_cast<const struct nsm_msg*>(payload);
   46|    102|    const struct nsm_msg_hdr* hdr = reinterpret_cast<const struct nsm_msg_hdr*>(payload);
   47|       |
   48|       |    // Mismatch prevention: verify request/response type
   49|    102|    if (hdr->request != false) {
  ------------------
  |  Branch (49:9): [True: 5, False: 97]
  ------------------
   50|      5|        return 0;
   51|      5|    }
   52|       |
   53|     97|    std::vector<uint8_t> out_buf(65536, 0);
   54|     97|    uint8_t fuzz_cc = 0;
   55|     97|    std::vector<uint8_t> fuzz_data_size_buf(65536, 0);
   56|     97|    uint16_t* fuzz_data_size = reinterpret_cast<uint16_t*>(fuzz_data_size_buf.data());
   57|     97|    uint16_t fuzz_reason_code = 0;
   58|     97|    decode_common_resp(msg, payload_len, &fuzz_cc, fuzz_data_size, &fuzz_reason_code);
   59|       |
   60|     97|    return 0;
   61|    102|}

_Z23validate_nsm_msg_lengthPKhm:
   27|    105|inline bool validate_nsm_msg_length(const uint8_t* payload, size_t payload_len) {
   28|    105|    return payload_len >= sizeof(struct nsm_msg_hdr);
   29|    105|}

decode_reason_code_and_cc:
  705|     97|{
  706|     97|	if (msg == NULL || cc == NULL || reason_code == NULL) {
  ------------------
  |  Branch (706:6): [True: 0, False: 97]
  |  Branch (706:21): [True: 0, False: 97]
  |  Branch (706:35): [True: 0, False: 97]
  ------------------
  707|      0|		return NSM_SW_ERROR_NULL;
  708|      0|	}
  709|       |
  710|     97|	*cc = ((struct nsm_common_resp *)msg->payload)->completion_code;
  711|     97|	if (*cc == NSM_SUCCESS || *cc == NSM_ACCEPTED) {
  ------------------
  |  Branch (711:6): [True: 44, False: 53]
  |  Branch (711:28): [True: 1, False: 52]
  ------------------
  712|     45|		return NSM_SW_SUCCESS;
  713|     45|	}
  714|       |
  715|     52|	if (msg_len != (sizeof(struct nsm_msg_hdr) +
  ------------------
  |  Branch (715:6): [True: 45, False: 7]
  ------------------
  716|     52|			sizeof(struct nsm_common_non_success_resp))) {
  717|     45|		return NSM_SW_ERROR_LENGTH;
  718|     45|	}
  719|       |
  720|      7|	struct nsm_common_non_success_resp *response =
  721|      7|	    (struct nsm_common_non_success_resp *)msg->payload;
  722|       |
  723|       |	// reason code is expected to be present if CC != NSM_SUCCESS
  724|      7|	*reason_code = le16toh(response->reason_code);
  725|       |
  726|      7|	return NSM_SW_SUCCESS;
  727|     52|}
decode_common_resp:
  925|     97|{
  926|     97|	if (msg == NULL || cc == NULL || data_size == NULL) {
  ------------------
  |  Branch (926:6): [True: 0, False: 97]
  |  Branch (926:21): [True: 0, False: 97]
  |  Branch (926:35): [True: 0, False: 97]
  ------------------
  927|      0|		return NSM_SW_ERROR_NULL;
  928|      0|	}
  929|       |
  930|     97|	int rc = decode_reason_code_and_cc(msg, msg_len, cc, reason_code);
  931|     97|	if (rc != NSM_SW_SUCCESS || *cc != NSM_SUCCESS) {
  ------------------
  |  Branch (931:6): [True: 45, False: 52]
  |  Branch (931:30): [True: 8, False: 44]
  ------------------
  932|     53|		return rc;
  933|     53|	}
  934|       |
  935|     44|	if (msg_len <
  ------------------
  |  Branch (935:6): [True: 4, False: 40]
  ------------------
  936|     44|	    (sizeof(struct nsm_msg_hdr)) + sizeof(struct nsm_common_resp)) {
  937|      4|		return NSM_SW_ERROR_LENGTH;
  938|      4|	}
  939|       |
  940|     40|	struct nsm_common_resp *resp = (struct nsm_common_resp *)msg->payload;
  941|       |
  942|     40|	*data_size = le16toh(resp->data_size);
  943|       |
  944|     40|	return NSM_SW_SUCCESS;
  945|     44|}