run_engine

Coverage-guided mode. The program is built with -sanitize fuzzer (SanitizerCoverage plus the libFuzzer engine without its main); run_engine hands the engine control, and it calls engine_input with each input. Command line: libFuzzer's own flags and corpus directories, plus --only NAME to fuzz one case and --trace to print each input's case name (to learn which case a stored crash belongs to). The first input byte picks the case.

harness corpus/ -max_len=1024 -max_total_time=60 -artifact_prefix=crashes/

run_engine :: (cases: [] Case) -> s32