Coverage-guided kernel fuzzers such as syzkaller rely on edge coverage (trace-pc) as their sole feedback signal. This context-blind approach cannot distinguish execution paths that differ only in argument values -- for example, two invocations of copy_from_user() with different size parameters hit identical basic blocks yet have vastly different security implications. I present TOOLNAME, an LLVM-based instrumentation framework that extends Linux KCOV with data-flow extraction of function arguments and return values. A compiler pass emits lightweight callbacks capturing structured tuples of program counter, argument metadata, and field values at function entry and return. Composite types are automatically decomposed via DWARF DICompositeType metadata with zero source annotation. A lock-free per-task ring buffer delivers records to user space with no interference to existing KCOV or syzkaller infrastructure. I demonstrate dual utility: (1) fuzzers gain state-aware feedback for mutation guidance into value-dependent state transitions, and (2) security analysts obtain deterministic argument records for root-cause analysis without printk or kprobe overhead. Two Rust instrumentation paths are provided: a post-compilation pipeline requiring no rustc modification, and native instrumentation via rustc built against the custom LLVM -- both the only runtime methods for capturing Rust function arguments given that drgn/vmcore fails under -O2 DWARF elision.

翻译：覆盖率引导的内核模糊测试工具（如syzkaller）仅依赖边覆盖率（trace-pc）作为唯一反馈信号。这种上下文无关的方法无法区分仅参数值不同的执行路径——例如，两次调用copy_from_user()若仅size参数不同，虽击中相同基本块，却具有截然不同的安全影响。本文提出TOOLNAME，一种基于LLVM的插桩框架，通过扩展Linux KCOV实现函数参数与返回值的流式数据提取。编译器pass在函数入口与返回处发射轻量回调，捕获包含程序计数器、参数元数据及字段值的结构化元组。复合类型通过DWARF DICompositeType元数据自动分解，无需任何源码注解。无锁每任务环形缓冲区将记录传递至用户空间，且不与现有KCOV或syzkaller基础设施产生干扰。本文展示双重效用：（1）模糊测试工具获取状态感知反馈，针对依赖值的状态转移提供变异引导；（2）安全分析师无需printk或kprobe开销即可获取用于根因分析的确定性参数记录。提供两种Rust插桩路径：无需修改rustc的编译后流水线，以及基于自定义LLVM构建的rustc原生插桩——鉴于drgn/vmcore在-O2 DWARF省略条件下失败，两者均为当前运行时捕获Rust函数参数的唯一方法。