Stateful Embedded Fuzzing with Peripheral-Accurate SystemC Virtual Prototypes

Abstract: The increasing complexity of embedded software has made comprehensive manual testing impractical, motivating the use of automated techniques such as fuzzing. Coverage-guided fuzzers like AFL++ have shown strong results for conventional software but remain challenging to apply effectively in embedded contexts, where peripheral behaviors play critical roles. Existing approaches either use fast user-mode simulators, sacrificing peripheral realism, or rely on full-system simulators with manual instrumentation, limiting applicability to large-scale software. In this work, we present a novel framework that integrates AFL++ with a stateful SystemC-TLM virtual prototype to enable realistic fuzzing of embedded software. Fuzzer-generated inputs are injected directly into peripheral models, allowing peripherals to trigger natural side effects such as interrupts and FIFO updates. By integrating fuzzing with full-system simulation, our framework advances the effectiveness of pre-silicon testing for embedded systems. Results on embedded workloads show that our approach eliminates false positives while maintaining comparable code coverage and execution performance as state-of-the-art tools.

• The paper presents a framework that integrates AFL++ with SystemC-TLM virtual prototypes to enable peripheral-accurate fuzzing for embedded systems.
• It employs modular input injectors that emulate peripheral interactions, triggering realistic hardware side effects and accurately detecting faults.
• Comparative evaluation shows the stateful approach eliminates false positives and reliably detects bugs within minutes across various embedded applications.

Summary of "Stateful Embedded Fuzzing with Peripheral-Accurate SystemC Virtual Prototypes"

Introduction and Motivation

The pervasive escalation in embedded software complexity has rendered manual testing impracticable, necessitating automated assurance techniques such as fuzzing. Traditional coverage-guided fuzzers like AFL++ are effective in generic application domains, but their applicability to embedded systems is hampered by inadequate peripheral realism when using fast user-mode simulators, or cumbersome manual instrumentation for full-system simulation. This work introduces a framework integrating AFL++ with a stateful SystemC-TLM virtual prototype (VP), enabling peripheral-accurate fuzzing: fuzzer-generated inputs are injected directly into peripheral models, triggering authentic side effects (interrupts, FIFO updates, etc.) without any source or model instrumentation. The approach targets pre-silicon validation of software interacting with SoC peripherals—bare-metal, RTOS-driven, and HAL device drivers—extending fuzzing realism and diagnostic precision.

Figure 1: A schematic of simulation-based fuzz testing, illustrating integration between the AFL++ fuzzer, virtual prototype, and coverage collection.

Framework Architecture and Workflow

The framework maintains the established AFL++ fuzzing pipeline, requiring no changes to the fuzzer itself. Instead, the SystemC-TLM VP is extended to interface with AFL++ by collecting code coverage data, detecting crashes, and communicating via pipes and shared memory. The workflow proceeds through a handshake, VP configuration, execution (with input injectors periodically supplying fuzz data to peripherals), coverage reporting, and error signaling. This loop enables continuous coverage-guided mutation and evaluation.

Figure 2: Workflow steps of the fuzzing process, showing handshake, shared-memory setup, configuration, fuzz data injection, and coverage reporting.

Input injection is mediated by "injectors"—modules attached to peripherals via TLM sockets and to the fuzzer via shared memory. These injectors emulate external devices and deliver fuzzer inputs according to protocol-specific conventions. Trigger detection is handled by a probe inserted between the CPU and bus, which activates injectors only after peripheral configuration events (e.g., interrupt enable writes or register polls), preventing premature fuzz input delivery and ensuring realistic interaction.

Figure 3: An illustration of peer-to-peer injection logic—showing probes and injectors enabling dynamic peripheral interaction upon firmware-trigger events.

Experimental Evaluation

The framework was evaluated across four embedded workloads: two bare-metal firmwares (drone and robot motor control), and two Zephyr OS applications (UART passthrough and CAN frame processing). Each workload exercised multiple peripherals (I²C, UART, Timer, CAN) with peripheral models from the VCML library, leveraging unchanged drivers and firmware.

Key vulnerabilities were synthesized and detected:

• Out-of-bounds read (I²C sensor data length unchecked): reliably triggers alignment faults.
• Invalid memory access (UART-driven MMIO offset): triggers bus faults.
• Divide-by-zero (CAN frame ratio unchecked): causes ARM hard faults.

Additionally, the tool uncovered latent bugs: firmware hangs due to misconfigured interrupt enable macros, and incorrect CAN frame handling in the driver. All vulnerabilities (injected and latent) were detected within the first 100 fuzzing executions (approx. minutes for complex targets), demonstrating diagnostic efficacy.

Figure 4: VP configuration for all experimental targets, depicting peripheral and injector layout per workload.

Comparative Analysis

The framework was benchmarked against two stateless VP-based fuzzing tools—Fuzzware and P2IM—using metrics of code coverage, unique crashes, and execution speed. Both prior tools generate numerous false positives: they misreport firmware hangs or spurious crashes due to a lack of peripheral causality (symbolic return values, uncorrelated interrupt triggering). Manual inspection reveals that stateless approaches frequently produce unrealistic traces, especially for complex peripherals.

In contrast, the stateful peripheral modeling in this framework eliminates false positives entirely, with all reported bugs corresponding directly to genuine software defects or realistic hardware-initiated faults.

Coverage is comparable or superior for most targets; Fuzzware reports higher coverage only for targets with weak peripheral modeling, at the expense of reliability. Execution speed is roughly half that achieved by stateless, user-mode simulation-based fuzzers, but the trade-off yields accurate hardware-peripheral semantics and realistic execution conditions.

Figure 5: Code coverage comparison for the various tools, highlighting coverage parity and superior diagnostic precision for the stateful approach.

Implications and Future Directions

This framework advances fuzz testing in embedded settings by coupling realistic peripheral simulation with coverage-guided input generation, enabling scalable pre-silicon validation of complex firmware stacks and device drivers, including closed-source binaries. The elimination of false positives enhances diagnostic clarity—critical for industrial software assurance workflows and regulatory compliance. While full-system simulation incurs performance penalties relative to stateless fuzzers, the improved realism and reliability justify the cost for safety- and mission-critical embedded platforms.

Potential future developments include automating peripheral model generation from vendor specifications, broadening device support, and deploying parallelized simulation to offset performance bottlenecks. The integration of peripheral-accurate fuzzing into standard development pipelines would facilitate early detection of vulnerabilities, reduce reliance on physical hardware, and accelerate secure system design.

Conclusion

This paper presents a stateful, peripheral-accurate embedded fuzzing framework leveraging SystemC-TLM virtual prototypes and modular input injection, systematically closing the realism gap between coverage-guided fuzzing and embedded system simulation. The approach enables robust pre-silicon validation by detecting both synthesized and latent memory safety defects, outperforms stateless fuzzers by eliminating false positives, and delivers diagnostic fidelity required for complex, safety-driven embedded software. The framework architecture and evaluation signal practical pathways for enhanced security testing and future scalability in hardware/software co-design.