The mutation engine turns one input into many candidates through a documented strategy set: bit flips, byte flips, arithmetic (add/subtract small integers), interesting values (0, -1, MAX_INT and other known edge cases), block operations (delete/insert/duplicate), dictionary-based injection of protocol keywords, cross-over splicing of two inputs, and structure-aware mutation that respects protocol grammar. Strategies are weightable; the USAGE guide shows a mutations.yaml assigning weights (e.g. bitflip 30, byteflip 20, arithmetic 15, interesting 10, dictionary 15, havoc 10).

The engine exposes a simple mutate(input_data: bytes, strategy: str) -> bytes interface and uses NumPy for efficient byte manipulation, which keeps the per-mutation cost low despite the pure-Python implementation. Dictionaries (e.g. GET, POST, Content-Length, ../../../etc/passwd, format-string and null-byte tokens) inject semantically meaningful fragments that random mutation would rarely produce. Cross-over splices interesting inputs together to combine partial progress from two corpus entries.

Structure-aware mutation is the bridge to §4.3: for grammar-defined protocols, the engine mutates payload fields while preserving structural invariants like magic numbers and computed lengths. The relative effectiveness of each strategy (which weights find the most coverage or crashes on a given target) is Additional validation required; the strategies and their configurability are documented, comparative effectiveness is not.