ProtoCrash’s core is a coverage-guided feedback loop implemented in pure Python. The documented algorithm: while fuzzing is active, select an input from the queue weighted by coverage, mutate it with the strategy set, execute the target, collect coverage feedback, and branch: if new coverage is found, add the input to the corpus and mark it interesting; if a crash is detected, save the input and triage it; otherwise discard. Statistics update every iteration and drive the real-time dashboard.

The novelty test lives in the coverage tracker. It maintains a Dict[edge_id, hit_count] map, records edges as branch transitions (A→B), and buckets hit counts into 1, 2, 3, 4-7, 8-15, and 16+. An input is “interesting” if it lights up a new edge or pushes an existing edge into a higher hit-count bucket, compared against the previous map. The map is kept in shared memory for fast comparison, which is what makes the novelty check affordable in Python. Targets are compiled with -fprofile-arcs -ftest-coverage to expose coverage, and the --coverage flag enables tracking.

The loop’s effectiveness depends on the scheduler feeding it good inputs (see §4.2 mutation and the favor-small/favor-coverage scheduling) and on the executor delivering inputs and detecting faults reliably (§4.5). A controlled measurement of coverage growth over an execution budget is Additional validation required; the mechanism is fully documented, the empirical curve is not.