Coverage-guided kernel fuzzers such as syzkaller rely on edge coverage trace-pc as their sole feedback signal. This context-blind approach cannot distinguish execution paths that differ only in argument values. For example, two invocations of copy_from_user() with different size parameters hit identical basic blocks yet have vastly different security implications. I present, an LLVM-based instrumentation framework that extends Linux KCOV with data-flow extraction of function arguments and return values. A compiler pass emits lightweight callbacks that report one source-level parameter per call, passing the value itself in a register together with its index and byte size. A composite is instead reported by the address of the object holding it, paired with a constant table of field (offset, size) pairs derived from DWARF DICompositeType metadata, with zero source annotation. The callbacks carry no program counter. The kernel derives it from the return address, which also attributes records the compiler emitted from inside an inlined body to the callee that was inlined. A lock-free per-task record buffer delivers variable-length records to user space with no interference to existing KCOV or syzkaller infrastructure, carrying entry, return, and comparison-operand records in one unified stream. I demonstrate dual utility: (1) fuzzers gain state-aware feedback for mutation guidance into value-dependent state transitions, and (2) security analysts obtain deterministic argument records for root-cause analysis without printk or kprobe overhead.

翻译：暂无翻译