Coverage-guided kernel fuzzers such as syzkaller rely on edge coverage (trace-pc) as their sole feedback signal. This context-blind approach cannot distinguish execution paths that differ only in argument values -- for example, two invocations of copy_from_user() with different size parameters hit identical basic blocks yet have vastly different security implications. I present TOOLNAME, an LLVM-based instrumentation framework that extends Linux KCOV with data-flow extraction of function arguments and return values. A compiler pass emits lightweight callbacks capturing structured tuples of program counter, argument metadata, and field values at function entry and return. Composite types are automatically decomposed via DWARF DICompositeType metadata with zero source annotation. A lock-free per-task ring buffer delivers records to user space with no interference to existing KCOV or syzkaller infrastructure. I demonstrate dual utility: (1) fuzzers gain state-aware feedback for mutation guidance into value-dependent state transitions, and (2) security analysts obtain deterministic argument records for root-cause analysis without printk or kprobe overhead. Two Rust instrumentation paths are provided: a post-compilation pipeline requiring no rustc modification, and native instrumentation via rustc built against the custom LLVM -- both the only runtime methods for capturing Rust function arguments given that drgn/vmcore fails under -O2 DWARF elision.

翻译：基于覆盖率的模糊测试工具（如syzkaller）仅使用边覆盖率（trace-pc）作为其唯一的反馈信号。这种上下文无关的方法无法区分仅在参数值上有所不同的执行路径——例如，调用copy_from_user()时传入不同大小的参数会命中相同的基本块，却具有截然不同的安全影响。本文提出了TOOLNAME，一个基于LLVM的插桩框架，通过扩展Linux KCOV实现了函数参数和返回值的自动数据流提取。其编译器pass在函数入口和返回处发出轻量级回调，捕获由程序计数器、参数元数据和字段值组成的结构化元组。复合类型通过DWARF DICompositeType元数据自动分解，无需任何源代码注解。无锁的每任务环形缓冲区将数据记录传递到用户空间，且不影响现有的KCOV或syzkaller基础设施。本文展示了双重用途：（1）模糊测试工具获得状态感知型反馈，用于引导能触发值相关状态突变的变异策略；（2）安全分析师无需使用printk或kprobe开销，即可获得用于根因分析的确定性参数记录。此外，本文提供了两种Rust插桩路径：无需修改rustc的后编译流水线，以及通过基于自定义LLVM构建的rustc实现的原生插桩——鉴于drgn/vmcore在-O2下因DWARF省略而失效，这两种方法是目前运行时捕获Rust函数参数唯一可行方案。