DirectFuzz

Overview

DirectFuzz is a directed graybox fuzzing (DGF) tool for hardware designs. It is described in the literature as a DGF-based implementation that builds upon RFuzz and aims to bring directionality into the fuzzing process in order to improve targeted coverage of hardware designs.

Origin and Relationship to RFuzz

DirectFuzz was developed as a follow-up to RFuzz. Where RFuzz focuses on coverage-driven fuzzing to test the entire design, DirectFuzz implements directed fuzzing, which allows the fuzzer to focus its effort on certain submodules within a larger system rather than the whole design. This is described as useful when a system contains several subsystems or components, and when new components are progressively added to a large system; the fuzzer can save time by directing focus on the newly added component instead of re-fuzzing older parts that remained unchanged.

Implementation Approach

DirectFuzz, like its predecessor RFuzz, uses Verilator to simulate the hardware design. Verilator is an open-source tool that compiles Verilog or SystemVerilog code into an optimized, potentially multithreaded C++/SystemC model that executes faster than traditional interpreted simulators.

The fuzzer setup with Verilator consists of:

• A CPU side containing the fuzzer
• Shared memory buffers used for communication, comprising:
  • An input buffer
  • A coverage buffer

The fuzzer communicates with the Design Under Test (DUT) via these buffers in shared memory.

Directionality and Use Cases

The directed fuzzing capability of DirectFuzz is intended to support scenarios such as:

• Module-specific testing
• Targeting specific submodules in a larger design
• Focusing on newly added components in an evolving design
• Improving targeted coverage metrics

Known Limitations

Although DirectFuzz introduced directionality into hardware fuzzing, the PROFUZZ paper identifies several limitations:

1. Inability to capture hardware-specific semantics and structure — abstraction mismatches arise because Verilator-based simulation introduces a software-level abstraction that cannot fully capture intrinsic hardware characteristics such as concurrency and signal interactions.
2. Misaligned coverage metrics — the coverage metrics used do not align well with established verification practices.
3. Limited scalability — the approach scales poorly when targeting multiple design regions.
4. Inability to perform targeted verification across multiple modules — the framework does not generalize to verifying several modules at once.

These limitations motivated subsequent work, notably PROFUZZ, which operates directly at the hardware's native abstraction level (RTL), uses hardware-specific coverage metrics, and integrates with industry-standard EDA tools to address scalability and cross-module verification.

Significance

DirectFuzz represents an important step in the evolution of hardware-directed fuzzing, transitioning from generic coverage-driven approaches (such as RFuzz) toward focused, targeted verification of specific hardware components. Its limitations, particularly around abstraction mismatch via Verilator and scalability, have shaped subsequent research into RTL-native directed fuzzing frameworks.