CFGuide-Fuzz: Dynamic Fuzz Testing Framework Based on Control Flow Features

RTL-level fuzz testing is critical for identifying vulnerabilities in hardware designs. However, existing hardware fuzz testing methods suffer from slow coverage improvement and blind exploration due to the lack of fine-grained control flow guidance. To address this gap, this article proposes the CFGuide-Fuzz framework, which includes control node extraction and compression techniques based on FIRRTL instrument and a hardware fuzz engine driven by feature feedback. This research introduces a fine-grained control flow feedback mechanism for hardware fuzz testing, enabling a pivotal shift from blind exploration to targeted testing. Experimental results demonstrate that compared to the DiFuzzRTL baseline, the proposed CFGuide-Fuzz framework enhances register state coverage by 9.4% under identical iteration counts and testing environments. Additionally, it doubles the number of effective inputs that trigger mismatched differential test results. These findings fully validate the framework’s dual advantages: deeper hardware control flow exploration and higher semantic vulnerability triggering efficiency.