Modern hardware systems, from resource-constrained compact edge devices to complex, heterogeneous platforms, are rapidly evolving to support the increasing demands of next-generation applications. These designs often integrate billions of transistors and a wide range of components, making the hardware verification process both critical and increasingly challenging. Despite significant advances, traditional verification techniques, including functional and formal methods [1, 2, 3], struggle to scale with the growing complexity of hardware designs to expose subtle or potential vulnerabilities. Recent advancements in leveraging Large Language Models in automating bug identification and mitigation [4, 5, 6, 7, 8, 9, 10] have shown promise, but these techniques remain limited in their scope and accuracy, paving the way for fuzzing as a complementary approach to uncover deeper, hard-to-find bugs. Fuzzing is an automated testing method that repeatedly generates inputs, often randomly or through guided mutation, to expose bugs, crashes, or unexpected behaviors [11]. Inspired by well-established software fuzzing techniques, hardware fuzzing techniques emerged as a promising verification approach [12, 13, 14, 15, 16, 17, 18, 19, 20]. Coverage-Guided Graybox Fuzzing (CGF) [12] has become a foundational technique in this space, and RTL-level Fuzzing frameworks like [18, 21, 14, 22] have demonstrated effectiveness in achieving broad coverage, particularly across designs with complex datapaths [23, 24]. In CGF, input generation is directed by feedback from real-time code coverage, allowing the fuzzer to prioritize input mutations that reveal unexplored paths in the design to improve functional coverage of RTL designs. While CGF-based techniques mark a significant advancement, they fall short in addressing the practical realities of hardware design workflows. Unlike software, hardware is typically developed incrementally, with new modules added or existing ones modified across design iterations. In such flows, verification efforts must focus on specific changes rather than re-testing the entire system. Directed Graybox Fuzzing (DGF) has been proposed as an alternative, which, unlike CGF, enables targeted fuzzing by steering test generation toward specific regions of interest. This is particularly useful in scenarios such as patch validation, bug localization, or module-specific testing. DirectFuzz [25], a DGF-based implementation, aimed to bring directionality into the fuzzing process to improve targeted coverage. Despite its innovation, DirectFuzz exhibits several key limitations, including (i) inability to capture hardware-specific semantics and structure, (ii) misaligned coverage metrics that do not align well with established verification practices, (iii) limited scalability when targeting multiple design regions, and (iv) an inability to perform targeted verification across multiple modules. These challenges motivate the need for a more scalable and structurally aware directed fuzzing framework tailored to the realities of modern hardware design and verification.

In this work, we present PROFUZZ, a novel hardware fuzzing framework based on DGF, specifically designed to overcome the challenges, such as abstraction mismatches, limited coverage precision, and poor scalability. Unlike existing methods, PROFUZZ operates directly at the hardware’s native abstraction level, allowing it to accurately model inherent hardware behaviors and utilize coverage metrics that reflect hardware-specific characteristics. Additionally, our framework seamlessly integrates with industry-standard Electronic Design Automation (EDA) tools, facilitating easy adoption within established design and verification workflows.