I expected byte mutation to lose because its mutants die at the decoder. Measured, they decode fine. About 83% of them decode to the value you already had. nelli mutates the typed choice sequence instead, and reaches 18 edges of a parser where byte mutation reaches 2.
nelli is a Nim testing library built on a choice-sequence engine. Because a test input is just a recorded sequence of typed choices, the same engine drives property testing, coverage-guided fuzzing, and SMT-backed symbolic execution.
How designing the fuzz harness around real attacker surface, instead of pointing libfuzzer at every parser I could see, surfaced an unbounded allocation in russh’s keyboard-interactive auth in under 20 minutes.