RFUZZ

Tool

RFUZZ is a Rust-based public research platform described by its GitHub repository as “coverage-directed fuzzing for RTL.” ProcessorFuzz places RFUZZ in the hardware-fuzzing/RTL-verification context and reports a 97% runtime overhead for RFUZZ in a comparison of prior approaches.

First seen 5/26/2026

Last seen 6/9/2026

Evidence 19 chunks

Wiki v4

WIKI

Overview

RFUZZ is a public research platform for coverage-directed fuzzing of RTL hardware designs. The ekiwi/rfuzz GitHub repository describes the project as “coverage-directed fuzzing for RTL research platform.” The repository metadata identifies Rust as the primary language and lists 114 stars, 14 forks, and an update timestamp of 2026-03-30. [RFUZZ GitHub repository]

Technical context

READ FULL ARTICLE →

NEIGHBORHOOD

4 nodes · 4 edges

graph · RFUZZ · depth=1

RELATIONSHIPS

18 connections

DiFuzzRTL ← compares with 100% 3e

DIFUZZRTL is compared against RFuzz, the state-of-the-art RTL fuzzer, showing 40x faster execution and 6.4x faster state exploration.

Mux Toggle Coverage uses → 98% 2e

RFUZZ uses multiplexer toggle coverage as its feedback metric

multiplexer toggle coverage implements → 90% 2e

RFUZZ uses multiplexer toggle coverage as its hardware coverage metric.

Hardware fuzzing uses → 95% 2e

RFUZZ is a hardware fuzzing tool targeting RTL designs

Chisel HDL implements → 90% 2e

RFUZZ is coupled to Chisel HDL.

multiplexer toggle coverage implements → 90% 2e

RFUZZ implements multiplexer toggle coverage for hardware fuzzing.

Mux-Coverage Guided Fuzzing implements → 100% 2e

RFuzz implements mux-coverage guided fuzzing as its core coverage technique.

input-stimuli fuzzing implements → 100% 2e

RFUZZ is an input-stimuli fuzzing tool adapted from American Fuzzy Lop for hardware verification.

multiplexer toggle coverage uses → 90% 1e

RFUZZ uses multiplexer toggle coverage for hardware fuzzing.

ProcessorFuzz ← compares with 85% 1e

ProcessorFuzz is described as HDL-agnostic in contrast to RFUZZ which is coupled to Chisel HDL.

ProcessorFuzz ← mentions 90% 1e

ProcessorFuzz paper mentions RFUZZ as a prior work with high instrumentation overhead.

FPGA Acceleration uses → 90% 1e

RFUZZ combines fuzzing with FPGA acceleration for hardware verification.

Effective Processor Verification with Logic Fuzzer Enhanced Co-simulation ← compares with 90% 1e

The paper discusses RFUZZ as related work in input-stimuli fuzzing and distinguishes it from Logic Fuzzer.

Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing ← compares with 70% 1e

The paper mentions RFUZZ as a related fuzzing approach for hardware verification.

Coverage-based Greybox Fuzzing implements → 85% 1e

RFUZZ is a hardware fuzzer that instruments processor RTL for coverage-guided fuzzing.

Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing ← mentions 90% 1e

The paper mentions RFUZZ as a related hardware fuzzing approach combining fuzzing with FPGA acceleration.

DirectFuzz ← compares with 98% 1e

DirectFuzz is experimentally compared against RFUZZ

Chisel HDL uses → 95% 1e

RFUZZ is tightly coupled to Chisel HDL

LINKED ENTITIES

2 links

multiplexer toggle coverage IMPLEMENTS Extracted graph relationship

Chisel HDL IMPLEMENTS Extracted graph relationship

CITATIONS

4 sources

4 citations — click to collapse

[1] RFUZZ is described by its public GitHub repository as a coverage-directed fuzzing platform for RTL research; the repository metadata lists Rust as the language, 114 stars, 14 forks, and an update timestamp of 2026-03-30. ekiwi/rfuzz

[2] ProcessorFuzz places RFUZZ in the broader context of hardware fuzzing for RTL verification and explains that software-style coverage metrics such as basic-block and branch coverage are not well suited for hardware fuzzing. ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance

[3] ProcessorFuzz identifies multiplexer toggle coverage and register coverage as hardware-tailored coverage metrics intended to guide fuzzers toward uncovered processor FSM states using hardware-intrinsic information. ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance

[4] ProcessorFuzz reports 97% runtime overhead for RFUZZ. ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance