LLVMFuzzerTestOneInput:
   35|     76|extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
   36|     76|    if (size < 2) return 0;
  ------------------
  |  Branch (36:9): [True: 1, False: 75]
  ------------------
   37|       |
   38|     75|    const uint8_t* payload = data;
   39|     75|    size_t payload_len = size;
   40|       |
   41|     75|    if (!validate_nsm_msg_length(payload, payload_len)) {
  ------------------
  |  Branch (41:9): [True: 3, False: 72]
  ------------------
   42|      3|        return 0;
   43|      3|    }
   44|       |
   45|     72|    const struct nsm_msg* msg = reinterpret_cast<const struct nsm_msg*>(payload);
   46|     72|    const struct nsm_msg_hdr* hdr = reinterpret_cast<const struct nsm_msg_hdr*>(payload);
   47|       |
   48|       |    // Mismatch prevention: verify request/response type
   49|     72|    if (hdr->request != true) {
  ------------------
  |  Branch (49:9): [True: 11, False: 61]
  ------------------
   50|     11|        return 0;
   51|     11|    }
   52|       |
   53|     61|    std::vector<uint8_t> out_buf(65536, 0);
   54|     61|    std::vector<uint8_t> fuzz_histogram_id_buf(65536, 0);
   55|     61|    uint32_t* fuzz_histogram_id = reinterpret_cast<uint32_t*>(fuzz_histogram_id_buf.data());
   56|     61|    std::vector<uint8_t> fuzz_parameter_buf(65536, 0);
   57|     61|    uint16_t* fuzz_parameter = reinterpret_cast<uint16_t*>(fuzz_parameter_buf.data());
   58|     61|    decode_get_histogram_data_req(msg, payload_len, fuzz_histogram_id, fuzz_parameter);
   59|       |
   60|     61|    return 0;
   61|     72|}

_Z23validate_nsm_msg_lengthPKhm:
   27|     75|inline bool validate_nsm_msg_length(const uint8_t* payload, size_t payload_len) {
   28|     75|    return payload_len >= sizeof(struct nsm_msg_hdr);
   29|     75|}

decode_get_histogram_data_req:
 1336|     61|{
 1337|     61|	if (msg == NULL || histogram_id == NULL || parameter == NULL) {
  ------------------
  |  Branch (1337:6): [True: 0, False: 61]
  |  Branch (1337:21): [True: 0, False: 61]
  |  Branch (1337:45): [True: 0, False: 61]
  ------------------
 1338|      0|		return NSM_SW_ERROR_NULL;
 1339|      0|	}
 1340|       |
 1341|     61|	if (msg_len <
  ------------------
  |  Branch (1341:6): [True: 5, False: 56]
  ------------------
 1342|     61|	    sizeof(struct nsm_msg_hdr) + sizeof(nsm_get_histogram_data_req)) {
 1343|      5|		return NSM_SW_ERROR_LENGTH;
 1344|      5|	}
 1345|       |
 1346|     56|	nsm_get_histogram_data_req *request =
 1347|     56|	    (nsm_get_histogram_data_req *)msg->payload;
 1348|       |
 1349|     56|	if (request->hdr.data_size <
  ------------------
  |  Branch (1349:6): [True: 35, False: 21]
  ------------------
 1350|     56|	    sizeof(request->histogram_id) + sizeof(request->parameter)) {
 1351|     35|		return NSM_SW_ERROR_DATA;
 1352|     35|	}
 1353|       |
 1354|     21|	*histogram_id = le32toh(request->histogram_id);
 1355|     21|	*parameter = le16toh(request->parameter);
 1356|       |
 1357|     21|	return NSM_SW_SUCCESS;
 1358|     56|}