RFUZZ
ToolRFUZZ is a Rust-based public research platform described by its GitHub repository as “coverage-directed fuzzing for RTL.” ProcessorFuzz places RFUZZ in the hardware-fuzzing/RTL-verification context and reports a 97% runtime overhead for RFUZZ in a comparison of prior approaches.
First seen 5/26/2026
Last seen 9/16/2026
Evidence 62 chunks
Wiki v4
WIKI
Overview
RFUZZ is a public research platform for coverage-directed fuzzing of RTL hardware designs. The ekiwi/rfuzz GitHub repository describes the project as “coverage-directed fuzzing for RTL research platform.” The repository metadata identifies Rust as the primary language and lists 114 stars, 14 forks, and an update timestamp of 2026-03-30. [RFUZZ GitHub repository]
Technical context
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
50 connectionsCascade is compared to RFUZZ in terms of multiplexer select coverage.
RFUZZ uses Yosys for instrumentation passes.
The paper evaluates RFUZZ as a baseline comparison for Cascade.
RFUZZ uses multiplexer select coverage to guide the fuzzer to explore new design paths.
RFUZZ uses mux toggle coverage as its coverage metric.
DIFUZZRTL is compared against RFuzz, the state-of-the-art RTL fuzzer, showing 40x faster execution and 6.4x faster state exploration.
Lyra: A Hardware-Accelerated RISC-V Verification Framework with Generative Model-Based Processor Fuzzing ← mentions 100% 2e
The paper mentions RFUZZ as a related hardware fuzzing work.
RFuzz implements RTL fuzzing for hardware designs.
RFUZZ implements multiplexer toggle coverage for hardware fuzzing.
RFUZZ is coupled to Chisel HDL.
RFUZZ is an input-stimuli fuzzing tool adapted from American Fuzzy Lop for hardware verification.
RFUZZ uses multiplexer toggle coverage as its hardware coverage metric.
RFUZZ is a hardware fuzzer that applies a modified version of AFL to fuzz hardware.
RFUZZ is a hardware fuzzing tool targeting RTL designs
RFUZZ is a coverage-directed grey-box fuzzer for RTL.
RFuzz is cited as related hardware fuzzing research.
RFuzz implements mux-coverage guided fuzzing as its core coverage technique.
RFuzz uses AFL as its underlying fuzzing engine with mux coverage as feedback.
RFUZZ aims at maximizing multiplexer select coverage.
The paper mentions RFUZZ as a related approach combining fuzzing with FPGA acceleration.
The paper compares Cascade against RFUZZ on multiplexer select coverage
The RFuzz paper introduces the RFuzz hardware fuzzing tool.
RFuzz uses mux coverage instrumentation as hardware coverage feedback for AFL.
RFUZZ combines fuzzing with FPGA acceleration for hardware verification.
RFUZZ uses multiplexer select coverage to guide the fuzzer to explore new paths.
RFUZZ uses multiplexer select coverage as its coverage metric.
The paper mentions RFUZZ as a related hardware fuzzer.
RFUZZ uses mutation-based coverage-directed fuzzing on RTL.
RFUZZ is built around multiplexer select coverage as its coverage metric.
RFUZZ combines fuzzing with FPGA acceleration for hardware verification.
RFUZZ is a hardware fuzzer that instruments processor RTL for coverage-guided fuzzing.
The paper discusses RFUZZ as related work in input-stimuli fuzzing and distinguishes it from Logic Fuzzer.
RFUZZ introduced MUX coverage as a coverage metric for hardware fuzzing.
RFuzz uses Verilator to simulate the DUT in its simulation-based approach.
DirectFuzz is experimentally compared against RFUZZ
RFUZZ is tightly coupled to Chisel HDL
RFuzz implements an FPGA-accelerated approach by synthesizing the DUT on FPGA.
RFuzz uses DMA to communicate between the fuzzer and the synthesized DUT on FPGA.
The paper compares its approach against RFUZZ in a related work table.
RFUZZ uses multiplexer toggle coverage for hardware fuzzing.
DirectFuzz built upon RFuzz and implements directed fuzzing.
RFUZZ uses JQF as its fuzzing engine.
The FuzzWiz paper compares its approach with RFUZZ in a related work table.
The paper mentions RFUZZ as a related hardware fuzzing approach combining fuzzing with FPGA acceleration.
ProcessorFuzz paper mentions RFUZZ as a prior work with high instrumentation overhead.
RFUZZ is mentioned as a prior coverage-directed hardware fuzzing approach that HWFuzz advances beyond.
RFUZZ is compared with TheHuzz; RFUZZ only operates on select signals of MUXes while TheHuzz captures more behaviors.
RFUZZ is a state-of-the-art CPU fuzzer.
RFUZZ is classified as a random engine providing broad testcase diversity.
RFUZZ adapted the American Fuzzy Lop framework for hardware testing.
CITATIONS
4 sources4 citations — click to collapse
[1] RFUZZ is described by its public GitHub repository as a coverage-directed fuzzing platform for RTL research; the repository metadata lists Rust as the language, 114 stars, 14 forks, and an update timestamp of 2026-03-30. ekiwi/rfuzz
[2] ProcessorFuzz places RFUZZ in the broader context of hardware fuzzing for RTL verification and explains that software-style coverage metrics such as basic-block and branch coverage are not well suited for hardware fuzzing. ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance
[3] ProcessorFuzz identifies multiplexer toggle coverage and register coverage as hardware-tailored coverage metrics intended to guide fuzzers toward uncovered processor FSM states using hardware-intrinsic information. ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance
[4] ProcessorFuzz reports 97% runtime overhead for RFUZZ. ProcessorFuzz: Processor Fuzzing with Control and Status Registers Guidance