Mutating structure, not bytes: nelli's IR-aware fuzzing
A byte fuzzer pointed at a structured input spends most of its budget on inputs the decoder throws away. nelli mutates the typed choice sequence directly, so every mutant is valid by construction, and it uses a comparison log to defeat magic-value branches exactly.