RFUZZ
ToolRFUZZ is a Rust-based public research platform described by its GitHub repository as “coverage-directed fuzzing for RTL.” ProcessorFuzz places RFUZZ in the hardware-fuzzing/RTL-verification context and reports a 97% runtime overhead for RFUZZ in a comparison of prior approaches.
First seen 5/26/2026
Last seen 7/15/2026
Evidence 54 chunks
Wiki v4
WIKI
Overview
RFUZZ is a public research platform for coverage-directed fuzzing of RTL hardware designs. The ekiwi/rfuzz GitHub repository describes the project as “coverage-directed fuzzing for RTL research platform.” The repository metadata identifies Rust as the primary language and lists 114 stars, 14 forks, and an update timestamp of 2026-03-30. [RFUZZ GitHub repository]
Technical context
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
47 connectionsRFUZZ uses multiplexer select coverage to guide the fuzzer to explore new design paths.
RFUZZ uses mux toggle coverage as its coverage metric.
Cascade is evaluated against RFUZZ on multiplexer select coverage
RFUZZ was adapted using Yosys passes to support Verilog
DIFUZZRTL is compared against RFuzz, the state-of-the-art RTL fuzzer, showing 40x faster execution and 6.4x faster state exploration.
The RFuzz paper introduces the RFuzz hardware fuzzing tool.
RFuzz uses mux coverage instrumentation as hardware coverage feedback for AFL.
RFUZZ is a hardware fuzzing tool targeting RTL designs
RFuzz uses AFL as its underlying fuzzing engine with mux coverage as feedback.
Lyra: A Hardware-Accelerated RISC-V Verification Framework with Generative Model-Based Processor Fuzzing ← mentions 100% 2e
The paper mentions RFUZZ as a related hardware fuzzing work.
RFUZZ implements multiplexer toggle coverage for hardware fuzzing.
RFuzz implements RTL fuzzing for hardware designs.
RFUZZ uses multiplexer select coverage to guide the fuzzer to explore new paths.
RFUZZ uses multiplexer select coverage as its coverage metric.
The paper mentions RFUZZ as a related hardware fuzzer.
RFUZZ uses mutation-based coverage-directed fuzzing on RTL.
RFuzz is cited as related hardware fuzzing research.
RFUZZ is coupled to Chisel HDL.
RFUZZ uses multiplexer toggle coverage as its hardware coverage metric.
RFuzz implements mux-coverage guided fuzzing as its core coverage technique.
RFUZZ is an input-stimuli fuzzing tool adapted from American Fuzzy Lop for hardware verification.
RFUZZ is a hardware fuzzer that applies a modified version of AFL to fuzz hardware.
RFUZZ aims at maximizing multiplexer select coverage.
The paper evaluates RFUZZ as a baseline for comparison.
The paper compares Cascade against RFUZZ on multiplexer select coverage
RFUZZ is mentioned as a prior coverage-directed hardware fuzzing approach that HWFuzz advances beyond.
RFUZZ combines fuzzing with FPGA acceleration for hardware verification.
The paper discusses RFUZZ as related work in input-stimuli fuzzing and distinguishes it from Logic Fuzzer.
The paper mentions RFUZZ as a related fuzzing approach for hardware verification.
RFUZZ adapted the American Fuzzy Lop framework for hardware testing.
RFUZZ is a hardware fuzzer that instruments processor RTL for coverage-guided fuzzing.
ProcessorFuzz paper mentions RFUZZ as a prior work with high instrumentation overhead.
DirectFuzz is experimentally compared against RFUZZ
RFUZZ is tightly coupled to Chisel HDL
Its methodology is explicitly coverage-directed.
The paper compares its approach against RFUZZ in a related work table.
RFUZZ uses multiplexer toggle coverage for hardware fuzzing.
RFUZZ uses JQF as its fuzzing engine.
The FuzzWiz paper compares its approach with RFUZZ in a related work table.
RFUZZ is compared with TheHuzz; RFUZZ only operates on select signals of MUXes while TheHuzz captures more behaviors.
RFUZZ is a state-of-the-art CPU fuzzer.
RFuzz uses Verilator to simulate the DUT in its simulation-based approach.
RFuzz implements an FPGA-accelerated approach by synthesizing the DUT on FPGA.
RFuzz uses DMA to communicate between the fuzzer and the synthesized DUT on FPGA.
DirectFuzz built upon RFuzz and implements directed fuzzing.
RFUZZ introduced MUX coverage as a coverage metric for hardware fuzzing.
The paper mentions RFUZZ as a related hardware fuzzing approach combining fuzzing with FPGA acceleration.
CITATIONS
4 sources4 citations — click to collapse
[1] RFUZZ is described by its public GitHub repository as a coverage-directed fuzzing platform for RTL research; the repository metadata lists Rust as the language, 114 stars, 14 forks, and an update timestamp of 2026-03-30. ekiwi/rfuzz
[2] ProcessorFuzz places RFUZZ in the broader context of hardware fuzzing for RTL verification and explains that software-style coverage metrics such as basic-block and branch coverage are not well suited for hardware fuzzing. ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance
[3] ProcessorFuzz identifies multiplexer toggle coverage and register coverage as hardware-tailored coverage metrics intended to guide fuzzers toward uncovered processor FSM states using hardware-intrinsic information. ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance
[4] ProcessorFuzz reports 97% runtime overhead for RFUZZ. ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance