Detection and triage are built into the tool rather than left to external scripts. The target executor spawns the target, delivers the test case via stdin, network, or file, enforces a timeout to catch hangs, applies CPU/memory/FD/process limits, and monitors for crash signals: SIGSEGV, SIGABRT, SIGILL, and SIGFPE. ASan and MSan integration raises detection fidelity for memory errors that would not otherwise signal.

Triage then makes the output actionable. protocrash analyze buckets crashes by signal and fault signature, parses and deduplicates stack traces (via GDB), classifies exploitability/severity, and minimizes inputs to minimal reproducers. The documented triage example collapses 127 raw crashes into 5 unique buckets (SIGSEGV null-deref 89, heap-overflow 23, SIGABRT assert-fail 12, stack-overflow 2, SIGILL bad-instruction 1). Reports generate in text, JSON (for automation/CI), and HTML (with charts), and protocrash reproduce re-runs a saved crash against the target.

The categories and workflow are fully documented. The internal exploitability-classification heuristics and the bucketing accuracy (false-merge/false-split rates against labeled ground truth) are Additional validation required; those are exactly the numbers that would let a researcher calibrate trust in the automated severity ranking.