Zephyr currently supports fuzzing through libFuzzer, an in-process, coverage-guided fuzzer from the LLVM ecosystem. Developers create a fuzzing harness that passes generated input to the target function, while SanitizerCoverage collects execution information.

libFuzzer is fast and useful for API-level targets, short CI runs, parsers, cryptographic libraries, and network stacks. However, because the fuzzer and target run in the same process, a target crash also terminates the fuzzer. They also share the same memory space.

The session then introduced AFL++, a widely used open source, coverage-guided fuzzer. AFL++ traditionally runs the fuzzer and target in separate processes, providing isolation when the target crashes. It supports both Clang and GCC and includes modes such as persistent mode, QEMU mode, Frida mode, and Unicorn mode.

Jayashree presented early work to integrate AFL++ with Zephyr’s native simulator platform. The Zephyr application is compiled using the AFL++ toolchain, creating an instrumented executable that can be tested with afl-fuzz.

Using this setup, the team was able to detect intentionally injected crashes. AFL++ saved the input that caused the crash, which could then be replayed using GDB to obtain a backtrace.

The current implementation is limited to the native simulator platform. An RFC and pull request have been opened, but the work still requires refactoring before it can be merged.

Possible next steps include extending support to POSIX-based platforms and platforms supported by QEMU, exploring reusable peripheral models, and creating task-specific fuzzing contexts.

The immediate goal is to discuss these ideas with the Zephyr Security Working Group and gather feedback from the wider community.

The session concluded that Zephyr’s current libFuzzer integration is useful for API-level fuzzing, while AFL++ could help support longer fuzzing campaigns and broader application-level testing across Zephyr platforms.

Watch the session here. Check out the OSS NA 2026 playlist here.