Skip to content
STIMSMITH

Coverage-Guided Graybox Fuzzing (CGF)

Technique

Coverage-Guided Graybox Fuzzing (CGF) is a foundational hardware-fuzzing technique in which input generation is driven by real-time code-coverage feedback. In a CGF loop, the fuzzer prioritizes input mutations that reveal previously unexplored paths in a design, with the goal of improving functional coverage of RTL hardware. CGF-based RTL-level fuzzing frameworks have demonstrated broad coverage, particularly on designs with complex datapaths, although they do not by themselves target specific regions of interest the way Directed Graybox Fuzzing (DGF) does.

First seen 6/26/2026
Last seen 6/26/2026
Evidence 1 chunks
Wiki v1

WIKI

Coverage-Guided Graybox Fuzzing (CGF)

Overview

Coverage-Guided Graybox Fuzzing (CGF) is a hardware-verification technique in which a fuzzer repeatedly generates and mutates inputs while observing real-time code-coverage feedback from the design under test. Inputs that exercise previously unseen paths are retained and prioritized, so the campaign progressively expands the explored portion of the design and improves its functional coverage.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

2 connections
hardware fuzzing part of → 70% 1e
Indicates CGF is a key technique applied within hardware fuzzing workflows.
Code Coverage uses → 95% 1e
Establishes that CGF relies on code coverage as guidance for mutating and prioritizing inputs.

CITATIONS

4 sources
4 citations — click to collapse
[1] CGF has become a foundational technique in hardware fuzzing, inspired by well-established software fuzzing techniques. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[2] In CGF, input generation is directed by feedback from real-time code coverage, allowing the fuzzer to prioritize input mutations that reveal unexplored paths in the design to improve functional coverage of RTL designs. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[3] RTL-level fuzzing frameworks using CGF have demonstrated effectiveness in achieving broad coverage, particularly across designs with complex datapaths. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis
[4] CGF-based techniques fall short in addressing the practical realities of incremental hardware design workflows, motivating Directed Graybox Fuzzing (DGF) which, unlike CGF, enables targeted fuzzing by steering test generation toward specific regions of interest (e.g., patch validation, bug localization, module-specific testing). Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis